# Securing the Model Context Protocol (MCP): Risks, Controls, and Governance

arXiv: https://arxiv.org/abs/2511.20920 · HTML: https://mlsanity.com/paper/2511.20920/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Nov 2025.

## Built on by (most cited first, 23 of 23)

- [Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP](https://mlsanity.com/paper/2602.11327/) (2026)
- [Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning](https://mlsanity.com/paper/2603.22489/) (2026)
- [Do Coding Agents Understand Least-Privilege Authorization?](https://mlsanity.com/paper/2605.14859/) (2026)
- [Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions](https://mlsanity.com/paper/2602.03580/) (2026)
- [Polymer-Agent: Large Language Model Agent for Polymer Design](https://mlsanity.com/paper/2601.16376/) (2026)
- [MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents](https://mlsanity.com/paper/2602.14281/) (2026)
- [From Tool Orchestration to Code Execution: A Study of MCP Design Choices](https://mlsanity.com/paper/2602.15945/) (2026)
- [Autonomy and Agency in Agentic AI: Architectural Tactics for Regulated Contexts](https://mlsanity.com/paper/2605.12105/) (2026)
- [Verifiable Manifest Signing and Transparency Enforcement for Secure MCP-Based LLM Pipelines](https://mlsanity.com/paper/2601.23132/) (2026)
- [MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security](https://mlsanity.com/paper/2604.07551/) (2026)
- [Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems](https://mlsanity.com/paper/2603.07473/) (2026)
- [Bypassing Document Ingestion: An MCP Approach to Financial Q&A](https://mlsanity.com/paper/2603.20316/) (2026)
- [The Interlocutor Effect: Why LLMs Leak More Personal Data to Agents Than Humans](https://mlsanity.com/paper/2606.09844/) (2026)
- [A Decision-Centered Reference Architecture for Trustworthy Agentic Commerce](https://mlsanity.com/paper/2607.18347/) (2026)
- [ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure](https://mlsanity.com/paper/2608.24957/) (2026)
- [Security Risks in Tool-Enabled AI Agents: A Systematic Analysis of Privileged Execution Environments](https://mlsanity.com/paper/2605.09721/) (2026)
- [Understanding How Enterprises Adopt the Model Context Protocol for LLM-Driven Software Engineering](https://mlsanity.com/paper/2606.09182/) (2026)
- [Why Trust Your Agent? Empirical Security Gains from TRiSM-Guided Agentic Workflows in Healthcare](https://mlsanity.com/paper/2606.28666/) (2026)
- [An Agentic Interface for End-to-End Probabilistic Seismic Hazard and Risk Analysis](https://mlsanity.com/paper/2607.16249/) (2026)
- [Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents](https://mlsanity.com/paper/2607.18826/) (2026)
- [On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models](https://mlsanity.com/paper/2608.10530/) (2026)
- [AEGIS: Preventing Cross-Domain Resource Abuse in MCP](https://mlsanity.com/paper/2608.20481/) (2026)
- [Zero-Trust Authorization and Discovery for Enterprise MCP](https://mlsanity.com/paper/2609.22573/) (2026)

## Abstract (arXiv)

The Model Context Protocol (MCP) replaces static, developer-controlled API integrations with more dynamic, user-driven agent systems, which also introduces new security risks. As MCP adoption grows across community servers and major platforms, organizations encounter threats that existing AI governance frameworks (such as NIST AI RMF and ISO/IEC 42001) do not yet cover in detail. We focus on three types of adversaries that take advantage of MCP s flexibility: content-injection attackers that embed malicious instructions into otherwise legitimate data; supply-chain attackers who distribute compromised servers; and agents who become unintentional adversaries by over-stepping their role. Based on early incidents and proof-of-concept attacks, we describe how MCP can increase the attack surface through data-driven exfiltration, tool poisoning, and cross-system privilege escalation. In response, we propose a set of practical controls, including per-user authentication with scoped authorization, provenance tracking across agent workflows, containerized sandboxing with input/output checks, inline policy enforcement with DLP and anomaly detection, and centralized governance using private registries or gateway layers. The aim is to help organizations ensure that unvetted code does not run outside a sandbox, tools are not used beyond their intended scope, data exfiltration attempts are detectable, and actions can be audited end-to-end. We close by outlining open research questions around verifiable registries, formal methods for these dynamic systems, and privacy-preserving agent operations.