Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices

arXiv 2605.26159 ↗First posted 24 May 2026cs.NI cs.CR cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Large language models are increasingly used as orchestrators of external tools via the Model Context Protocol (MCP), but MCP is built for software services with megabytes of memory and does not descend to the microcontrollers that dominate the long tail of physical devices. Recent work (IoT-MCP) ports MCP to edge gateways at 74 KB peak memory; this still excludes the smallest commodity MCUs and, critically, does not address the safety problem of giving an unreliable caller (an LLM that may hallucinate or be prompt-injected) direct control of physical hardware. We present the Device Context Protocol (DCP): a sub-50-byte typical frame (6-byte header + CBOR payload + optional 16-byte HMAC), a manifest schema in which capability scoping, range and type checks, dry-run evaluation, and units-as-types are protocol-layer primitives, and a host-side Bridge that rejects malformed or hallucinated calls before any byte reaches the device. Reference firmware measures 27.6 KB flash / 0.6 KB RAM on ESP32; the Python Bridge, ESP32 firmware, and a language-neutral conformance suite are MIT-licensed and public. An empirical study -- 675 tool calls produced by five LLMs across four vendors (DeepSeek, Alibaba, Zhipu, MiniMax) against six categories of adversarial prompts, with the injection category instantiating AgentDojo's attack templates -- shows DCP rejects 100% of capability-escalation attempts and 78% of prompt-injection attempts, versus 0--1% for Raw MCP and IoT-MCP, matching the expressiveness of a well-formed OpenAPI 3 schema at three orders of magnitude less firmware footprint. We position DCP as the missing layer between MCP (which is moving toward enterprise SaaS connectivity) and the physical devices it does not reach.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 12 of its 27 references that are in the map. First posted on arXiv 24 May 2026.

Builds on

12 of 27 references.

References · 12

2022Survey of Hallucination in Natural Language Generationcited by 2,075
2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 538
2025RoboSafe: Safeguarding Embodied Agents via Executable Safety Logiccited by 14
2024Defining and Evaluating Physical Safety for Large Language Modelscited by 9
2025IoT-MCP: Bridging LLMs and IoT Systems Through Model Context Protocolcited by 9
2026Say the Mission, Execute the Swarm: Agent-Enhanced LLM Reasoning in the Web-of-Dronescited by 4
2026Skilled AI Agents for Embedded and IoT Systems Developmentcited by 3
2026From Prompt to Physical Actuation: Holistic Threat Modeling of LLM-Enabled Robotic Systemscited by 3
2025AegisMCP: Online Graph Intrusion Detection for Tool-Augmented LLMs on Edge Devicescited by 2
2026Agentic AI for Scalable and Robust Optical Systems Controlcited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way