Elamur Research⌕
☰
home / papers / 2026 / MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI

MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI

Paper · 2026 · Wenpeng Xing, Zhonghao Qi, Yupeng Qin et al.

Summary

Connecting LLM agents to external tools through the Model Context Protocol (MCP) opens new attack routes, including prompt injection, Tool Poisoning, Shadowing and data exfiltration. Existing protections are mostly regex gateways or offline scanners, and they miss semantically disguised payloads at runtime. The authors present MCP-Guard, a proxy that sits between the MCP Host and Server and checks traffic in three escalating steps. First, cheap pattern-based detectors catch obvious attacks. Second, a fully fine-tuned Multilingual E5 classifier scores semantic maliciousness. Third, an LLM arbitrator is called only for uncertain cases and can fall back on the neural score. To train and test the detector, they built MCP-AttackBench, a GPT-4-augmented collection of 70,448 samples covering MCP-specific threats. The best configuration reaches an F1 of 95.4%. The cascade also roughly halves latency compared with running an LLM detector alone, and it generalizes well to outside benchmarks. This shows that layered runtime inspection can make agent–tool ecosystems safer without large slowdowns.

Key points

  • Stage I (regex filters): 97.7% precision but only 38.9% recall, at about 1.8 ms per request. It acts as a fast first sieve.
  • Stage II (E5 classifier): an off-the-shelf E5 model reaches 65.37% accuracy. After fine-tuning on MCP-AttackBench it reaches 96.01% accuracy and 95.1% F1.
  • Full pipeline with GPT-4o-mini:
    • Average latency is 505.9 ms, a 1.56× speedup over standalone GPT-4o-mini (788.4 ms) and about 12× faster than MCP-Shield.
    • Across backbones, the average speedup is 2.04×.
    • The average F1 gain over standalone LLMs is 23.4 points, including a 61.2-point gain for TinyLlama-1.1B.
  • External benchmarks: on AgentDefense, MCPSecBench and RAS-Eval, Deepseek-chat as arbitrator averages 97.21% F1. Llama-3-8B averages 96.51% F1 with about 85 ms latency.
  • Limitations and release: the system covers text-only payloads and depends on the current MCP transport. MCP-AttackBench is planned for release under a research-only license, with personal data and credentials removed.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Zhejiang UniversityHangzhou · China172 works · 12,988 citations🎓Chinese University of Hong KongHong Kong · China126 works · 14,073 citations🎓Shandong UniversityJinan · China17 works · 789 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

Cite

Cite as Wenpeng Xing, Zhonghao Qi, Yupeng Qin, Yilin Li, Caini Chang, Jiahui Yu, Changting Lin, Zhenzhen Xie and Meng Han. 2026. MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.240

@inproceedings{xing2026mcp,
  title = {{MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI}},
  author = {Wenpeng Xing, Zhonghao Qi, Yupeng Qin, Yilin Li, Caini Chang, Jiahui Yu, Changting Lin, Zhenzhen Xie and Meng Han},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.240},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.240}
}

References

30 references, 2 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Anthropic. 2025. Introducing the model context protocol. https://www.anthropic.com/news/ model-context-protocol. Accessed: 2025-08-1. ↗
  2. Luca Beurer-Kellner and Marc Fischer. 2025. Mcp security notification: Tool poisoning attacks. Invariant Labs Blog. find
  3. Manish Bhatt, Vineeth Sai Narajala, and Idan Habler. 2025. Etdi: Mitigating tool squatting and rug pull attacks in model context protocol (mcp) by using oauth-enhanced tool definitions and policy-based access control. arXiv preprint arXiv:2506.01333. — [arXiv:2506.01333](https://arxiv.org/abs/2506.01333) find
  4. Ivo Brett. 2025. Simplified and secure mcp gateways for enterprise ai integration. Preprint. Available at https://independent.academia.edu/ivobrett. ↗
  5. Cloudflare. 2025. Mcp connectors on cloudflare workers. Cloudflare Blog. find
  6. Junfeng Fang, Zijun Yao, Ruipeng Wang, Haokai Ma, Xiang Wang, and Tat-Seng Chua. 2025. We should identify and mitigate third-party safety risks in mcp-powered agent systems. arXiv preprint arXiv:2506.13666v1. — [arXiv:2506.13666](https://arxiv.org/abs/2506.13666) find
  7. Yuchuan Fu, Xiaohan Yuan, and Dongxia Wang. 2025. Ras-eval: A comprehensive benchmark for security evaluation of llm agents in real-world environments. arXiv preprint arXiv:2506.15253. 4885 9 — [arXiv:2506.15253](https://arxiv.org/abs/2506.15253) find
  8. Yongjian Guo, Puzhuo Liu, Wanlun Ma, Zehang Deng, Xiaogang Zhu, Peng Di, Xi Xiao, and Sheng Wen. 2025. Systematic analysis of mcp security. arXiv preprint arXiv:2508.12538. — [arXiv:2508.12538](https://arxiv.org/abs/2508.12538) find
  9. Xinyi Hou, Yanjie Zhao, Shenao Wang, and Haoyu Wang. 2025. Model context protocol (mcp): Landscape, security threats, and future research directions. arXiv preprint arXiv:2503.23278. Huazhong University of Science and Technology, China. — [arXiv:2503.23278](https://arxiv.org/abs/2503.23278) find
  10. Invariant-Labs. 2024. Mcp-scan: A lightweight security detection framework. https://github.com/ invariantlabs-ai/mcp-scan. Accessed: 2025-07-31. ↗
  11. Huihao Jing, Haoran Li, Wenbin Hu, Qi Hu, Xu Heli, Tianshu Chu, Peizhao Hu, and Yangqiu Song. 2025. Mcip: Protecting mcp safety via model contextual integrity protocol. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 1177–1194. find
  12. Nikita Kryzhanouski. 2024. Mcp-shield: Safety-constrained multi-agent path planning. https://github.com/riseandignite/mcp-shield. Accessed: 2025-07-31. ↗
  13. Sonu Kumar, Anubhav Girdhar, Ritesh Patil, and Divyansh Tripathi. 2025. Mcp guardian: A security-first layer for safeguarding mcp-based ai system. arXiv preprint arXiv:2504.12757. — [arXiv:2504.12757](https://arxiv.org/abs/2504.12757) find
  14. Minghao Li, Wenpeng Xing, Yong Liu, Wei Zhang, and Meng Han. 2025. Optimizing and attacking embodied intelligence: Instruction decomposition and adversarial robustness. In 2025 IEEE International Conference on Multimedia and Expo (ICME), pages 1–6. IEEE. find
  15. Rongchang Li, Minjie Chen, Chang Hu, Han Chen, Wenpeng Xing, and Meng Han. 2024. Gentel-safe: A unified benchmark and shielding framework for defending against prompt injection attacks. arXiv preprint arXiv:2409.19521. — [arXiv:2409.19521](https://arxiv.org/abs/2409.19521) find
  16. Vineeth Sai Narajala, Ken Huang, and Idan Habler. 2025. Securing genai multi-agent systems against tool squatting: A zero trust registry-based approach. arXiv preprint arXiv:2504.19951. — [arXiv:2504.19951](https://arxiv.org/abs/2504.19951) find
  17. Brandon Radosevich and John Halloran. 2025. Mcp safety audit: Llms with the model context protocol allow major security exploits. arXiv preprint arXiv:2504.03767. — [arXiv:2504.03767](https://arxiv.org/abs/2504.03767) find
  18. Arun Sanna. 2025. Agentdefense-bench: A security benchmark for mcp-based ai agents. find
  19. Bin Wang, Zexin Liu, Hao Yu, Ao Yang, Yenan Huang, Jing Guo, Huangsheng Cheng, Hui Li, and Huiyu Wu. 2025a. Mcpguard: Automatically detecting vulnerabilities in mcp servers. arXiv preprint arXiv:2510.23673. — [arXiv:2510.23673](https://arxiv.org/abs/2510.23673) find
  20. Liang Wang, Nan Yang, Xiaolong Huang, Binxing Jiao, Linjun Yang, Daxin Jiang, Rangan Majumder, and Furu Wei. 2022. Text embeddings by weakly-supervised contrastive pre-training. arXiv preprint arXiv:2212.03533.
  21. Zihan Wang, Hongwei Li, Rui Zhang, Yu Liu, Wenbo Jiang, Wenshu Fan, Qingchuan Zhao, and Guowen Xu. 2025b. Mpma: Preference manipulation attack against model context protocol. arXiv preprint arXiv:2506.02040. — [arXiv:2506.02040](https://arxiv.org/abs/2506.02040) find
  22. Wenpeng Xing, Minghao Li, Mohan Li, and Meng Han. 2025a. Towards robust and secure embodied ai: A survey on vulnerabilities and attacks. arXiv preprint arXiv:2502.13175. — [arXiv:2502.13175](https://arxiv.org/abs/2502.13175) find
  23. Wenpeng Xing, Mohan Li, Chunqiang Hu, Haitao XuN-ingyu Zhang, Bo Lin, and Meng Han. 2025b. Latent fusion jailbreak: Blending harmful and harmless representations to elicit unsafe llm outputs. arXiv preprint arXiv:2508.10029. — [arXiv:2508.10029](https://arxiv.org/abs/2508.10029) find
  24. Zhenhua Xu, Meng Han, and Wenpeng Xing. 2025a. Evertracer: Hunting stolen large language models via stealthy and robust probabilistic fingerprint. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 7019– 7042. find
  25. Zhenhua Xu, Meng Han, Xubin Yue, and Wenpeng Xing. 2025b. Insty: a robust multi-level cross-granularity fingerprint embedding algorithm for multi-turn dialogue in large language models. SCI-ENTIA SINICA Informationis, 55(8):1906. find
  26. Zhenhua Xu, Zhebo Wang, Maike Li, Wenpeng Xing, Chunqiang Hu, Chen Zhi, and Meng Han. 2025c. Rap-sm: Robust adversarial prompt via shadow models for copyright verification of large language models. arXiv preprint arXiv:2505.06304. — [arXiv:2505.06304](https://arxiv.org/abs/2505.06304) find
  27. Zhenhua Xu, Xubin Yue, Zhebo Wang, Qichen Liu, Xixiang Zhao, Jingxuan Zhang, Wenjun Zeng, Wengpeng Xing, Dezhang Kong, Changting Lin, et al. 2025d. Copyright protection for large language models: A survey of methods, challenges, and trends. arXiv preprint arXiv:2508.11548. — [arXiv:2508.11548](https://arxiv.org/abs/2508.11548) find
  28. Yixuan Yang, Daoyuan Wu, and Yufan Chen. 2025. Mcpsecbench: A systematic security benchmark and playground for testing model context protocols. arXiv preprint arXiv:2508.13220. — [arXiv:2508.13220](https://arxiv.org/abs/2508.13220) find
  29. Xubin Yue, Zhenhua Xu, Wenpeng Xing, Jiahui Yu, Mohan Li, and Meng Han. 2025. Pree: Towards harmless and adaptive fingerprint editing in large language models via knowledge prefix enhancement. Preprint. find
  30. Jingxuan Zhang, Zhenhua Xu, Rui Hu, Wenpeng Xing, Xuhong Zhang, and Meng Han. 2025. Meraser: An effective fingerprint erasure approach for large language models. arXiv preprint arXiv:2506.12551. 4886 10

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/xing-2026-mcp-guard-multi-stage-defense/