Model Context Protocol

The NSA's Artificial Intelligence Security Center released a cybersecurity information sheet on the Model Context Protocol, warning that adoption has outpaced safeguards. It recommends vetting MCP tools, least-privilege access and isolation, validating outputs where one model's output feeds another, and detailed logging integrated with security monitoring, and it lists poor approval workflows among the risks.

OX Security reports that MCP's STDIO transport turns configuration into OS command execution, and that frameworks exposing that configuration to users, networks or prompt injection inherited remote code execution, with 12+ CVEs across projects such as LangFlow, LiteLLM, Flowise and Windsurf. The Hacker News reports Anthropic characterized the protocol behavior as expected and did not change the reference design.

Wang and colleagues build MCPTox from 45 real MCP servers and 353 authentic tools, generating 1,312 malicious test cases across 10 risk categories. Across 20 LLM agents the highest attack success rate was 72.8% (o1-mini), and refusals were rare, with the highest refusal rate under 3% (Claude 3.7 Sonnet).

The 2025-06-18 revision of the Model Context Protocol specification classifies MCP servers as OAuth resource servers with protected resource metadata, and requires clients to implement RFC 8707 resource indicators so malicious servers cannot obtain tokens meant for others. It also clarifies authorization security considerations and adds a security best practices page.

Invariant Labs describes tool poisoning, in which instructions hidden in an MCP tool's description are visible to the model but not to the user, and shows proof-of-concept exfiltration of local files through an MCP client. It also describes rug pulls, where a server changes tool descriptions after approval, and shadowing, where one server's descriptions alter how the agent uses another server's tools. Recommended mitigations include showing full tool descriptions, pinning tool versions with checksums, and cross-server isolation.

Hou, Zhao, Wang and Wang survey MCP's architecture, industry adoption and server lifecycle. The first version (March 2025) split the lifecycle into creation, operation and update phases and discussed security risks in each. A revision in October 2025 expanded this to four phases with 16 activities and a threat taxonomy of four attacker types and 16 threat scenarios, with case studies and per-phase safeguards.