Hou, Zhao, Wang and Wang survey MCP's architecture, industry adoption and server lifecycle. The first version (March 2025) split the lifecycle into creation, operation and update phases and discussed security risks in each. A revision in October 2025 expanded this to four phases with 16 activities and a threat taxonomy of four attacker types and 16 threat scenarios, with case studies and per-phase safeguards.
Why it matters
It was an early systematic threat model for MCP as tool connectors spread through agent products.
Key facts
As stated in the sources, with where to find them.
- v1 (30 March 2025) defines a three-phase MCP server lifecycle (creation, operation, update) and discusses nine security risks, three per phase.v1 abstract; Section 5
- v3 (7 October 2025) taxonomy covers four attacker types (malicious developers, external attackers, malicious users, security flaws) and 16 threat scenarios across a four-phase, 16-activity lifecycle.v3 abstract; Section 1
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
Sources
Related records
Apr 1, 2025
Apr 15, 2026
Sep 25, 2025
Aug 19, 2025
Aug 5, 2025
Jul 9, 2025