📄 Securing the Tool Layer: A Threat Taxonomy and Runtime Defense Framework for Model Context Protocol Deployments

Summary

Agents that use external tools through the Model Context Protocol (MCP) can be compromised through the tools themselves rather than through the user. Attackers can poison tool metadata, hide instructions in returned data, or publish malicious server packages. Existing guardrails such as LlamaFirewall and NeMo Guardrails largely do not inspect this layer. The paper presents ShieldMCP, which has two parts. First, it condenses the 80+ techniques catalogued by the SAFE-MCP initiative into five priority attack families. Second, it adds a transparent proxy between client and servers that needs no changes to either side. The proxy checks traffic in three stages:

• Tool descriptions: a hash registry, an anomaly scan, and a distilled intent classifier.
• Outbound parameters: sanitization of the arguments the agent sends.
• Tool responses: token-level instruction detection, untrusted-data delimiters, and a session dependency graph.

In red-team tests across five LLM backends, average attack success fell from 70.9% to 9.5%. This beat both regex and LLM-judge baselines, with under 120ms of median added latency. The result points to a practical drop-in defense for production MCP use, although chained cross-tool attacks remain the weakest spot.

Key points

• Taxonomy: SAFE-MCP (OpenSSF, Linux Foundation) is adapted from MITRE ATT&CK and covers 14 tactic categories. The paper reduces it to five families: tool poisoning, indirect prompt injection via responses, supply chain compromise, rug pulls, and cross-tool chains.
• Classifier: the description classifier is distilled from a 3B-parameter model. It was fine-tuned on 8,400 benign and 3,200 adversarial descriptions, and items scoring above τ_d = 0.72 are quarantined for human review.
• Attack success rates: tool poisoning fell from 74.1% to 8.6%, indirect injection via responses from 47.2% to 5.8%, and cross-tool chains from 91.3% to 14.2%.
• Test setup and review: the harness used 40 MCP servers (25 benign, 15 adversarial). Three security engineers reviewing 50 alerts matched the ground truth in 92% of cases.
• Limitations: the classifier is trained only on English, cross-call correlation scales quadratically, and robustness to adaptive attackers is untested.