mlsanityData to 7 Oct 2026

Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem

arXiv 2512.08290 ↗First posted 9 Dec 2025cs.CR cs.AIcited by 14

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

The Model Context Protocol (MCP) has emerged as the de facto standard for connecting Large Language Models (LLMs) to external data and tools, effectively functioning as the "USB-C for Agentic AI." While this decoupling of context and execution solves critical interoperability challenges, it introduces a profound new threat landscape where the boundary between epistemic errors (hallucinations) and security breaches (unauthorized actions) dissolves. This Systematization of Knowledge (SoK) aims to provide a comprehensive taxonomy of risks in the MCP ecosystem, distinguishing between adversarial security threats (e.g., indirect prompt injection, tool poisoning) and epistemic safety hazards (e.g., alignment failures in distributed tool delegation). We analyze the structural vulnerabilities of MCP primitives, specifically Resources, Prompts, and Tools, and demonstrate how "context" can be weaponized to trigger unauthorized operations in multi-agent environments. Furthermore, we survey state-of-the-art defenses, ranging from cryptographic provenance (ETDI) to runtime intent verification, and conclude with a roadmap for securing the transition from conversational chatbots to autonomous agentic operating systems.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 20 of its 59 references that are in the map. First posted on arXiv 9 Dec 2025.

Builds on

20 of 59 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges27 Oct
  2. 2025Architecting Resilient LLM Agents: A Guide to Secure Plan-then-Execute Implementations10 Sep
  3. 2025MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers19 Aug
  4. 2025MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security18 Aug
  5. 2025TRiSM for Agentic AI: A Review of Trust, Risk, and Security Management in LLM-based Agentic Multi-Agent Systems4 Jun
  6. 2025A survey of agent interoperability protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP)4 May
  7. 2025MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits2 Apr

Other references · 13

  1. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,383
  2. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,185
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  4. 2018Scalable agent alignment via reward modeling: a research directioncited by 438
  5. 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directionscited by 257
  6. 2019Risks from Learned Optimization in Advanced Machine Learning Systemscited by 250
  7. 2022Goal Misgeneralization: Why Correct Specifications Aren't Enough For Correct Goalscited by 120
  8. 2025Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategiescited by 42
  9. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Modelscited by 21
  10. 2025ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Controlcited by 18
  11. 2024LongSafety: Enhance Safety for Long-Context LLMscited by 11
  12. 2020AGI Agent Safety by Iteratively Improving the Utility Functioncited by 8
1 more
  1. 2025Vulnerability Detection: From Formal Verification to Large Language Models and Hybrid Approaches: A Comprehensive Overviewcited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 14.

14 papers.

Sort:

By area:

  1. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 30
  2. 2026Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANPcited by 14
  3. 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Frameworkcited by 9
  4. 2026SoK: Agentic Retrieval-Augmented Generation (RAG): Taxonomy, Architectures, Evaluation, and Research Directionscited by 7
  5. 2026Autonomous Action Runtime Management(AARM):A System Specification for Securing AI-Driven Actions at Runtimecited by 5
  6. 2026From Tool Orchestration to Code Execution: A Study of MCP Design Choicescited by 3
  7. 2026Chunking, Retrieval, and Re-ranking: An Empirical Evaluation of RAG Architectures for Policy Document Question Answeringcited by 2
  8. 2026A Guide to Large Language Models in Modeling and Simulation: From Core Techniques to Critical Challengescited by 2
  9. 2026MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Securitycited by 1
  10. 2026A Taxonomy of Runtime Faults in Model Context Protocol Serverscited by 1
  11. 2026Cascading Hallucination in Agentic RAG: The CHARM Framework for Detection and Mitigationcited by 0
  12. 2026Agent Security Meets Regulatory Reality -- A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systemscited by 0
2 more
  1. 2026When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Callingcited by 0
  2. 2026AEGIS: Preventing Cross-Domain Resource Abuse in MCPcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms
  2. 2026Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions
  3. 2025Securing the Model Context Protocol (MCP): Risks, Controls, and Governance
  4. 2025MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers
  5. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols
  6. 2026Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents
  7. 2025MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI System
  8. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents