Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents
DOI:
https://doi.org/10.70777/si.v3i4.18910Keywords:
prompt injection, protocol security, LLM agents, formal analysis, Model Context ProtocolAbstract
The Model Context Protocol (MCP) has emerged as a de facto standard for integrating Large Language Models with external tools, yet no formal security analysis of the protocol specification exists. We present the first rigorous security analysis of MCP's architectural design, identifying three fundamental protocol-level vulnerabilities: (1) absence of capability attestation allowing servers to claim arbitrary permissions, (2) bidirectional sampling without origin authentication enabling server-side prompt injection, and (3) implicit trust propagation in multi-server configurations. We implement MCPBench, a novel framework bridging existing agent security benchmarks to MCP-compliant infrastructure, enabling direct measurement of protocol-specific attack surfaces. Through controlled experiments on 847 attack scenarios across five MCP server implementations, we demonstrate that MCP's architectural choices amplify attack success rates by 23--41% compared to equivalent non-MCP integrations. We propose MCPSec, a backward-compatible protocol extension adding capability attestation and message authentication, reducing attack success rates from 52.8% to 12.4% with median latency overhead of 8.3ms per message. Our findings establish that MCP's security weaknesses are architectural rather than implementation-specific, requiring protocol-level remediation.
References
[1]. K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection,” in Proc. ACM AISec, 2023.
[2]. Anthropic, “Model Context Protocol Specification v1.0,” Dec. 2024.
[3]. Y. Liu et al., “Prompt injection attack against LLM-integrated applications,” arXiv:2306.05499, 2024.
[4]. Q. Zhan et al., “InjecAgent: Benchmarking indirect prompt injections in tool-integrated LLM agents,” in Findings of ACL, 2024.
[5]. E. Debenedetti et al., “AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses in LLM agents,” in NeurIPS Datasets and Benchmarks, 2024.
[6]. Z. Zhang et al., “Agent-SafetyBench: Evaluating the safety of LLM agents,” arXiv:2412.14470, Dec. 2024.
[7]. M. Andriushchenko et al., “AgentHarm: A benchmark for measuring harmfulness of LLM agents,” in ICLR, 2025.
[8]. M. Lupinacci et al., “The dark side of LLMs: Agent-based attacks for complete computer takeover,” arXiv:2507.06850, 2025.
[9]. K. Hines et al., “Defending against indirect prompt injection attacks with spotlighting,” arXiv:2403.14720, 2024.
[10]. T. Shi et al., “PromptArmor: Simple yet effective prompt injection defenses,” arXiv:2507.15219, 2025.
[11]. W. Zou, R. Geng, B. Wang, and J. Jia, “PoisonedRAG: Knowledge corruption attacks on retrieval-augmented generation,” in USENIX Security, 2025.
[12]. F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” in NeurIPS ML Safety Workshop, 2022.
[13]. S. Schulhoff et al., “Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition,” in EMNLP, 2023.
[14]. OWASP Foundation, “OWASP Top 10 for LLM Applications 2025,” 2025.
[15]. I. Evtimov et al., “WASP: Web agent security against prompt injection,” in ICML, 2025.
[16]. A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does LLM safety training fail?” in NeurIPS, 2023.
[17]. Palo Alto Networks Unit 42, “Model Context Protocol attack vectors and security analysis,” 2025.
[18]. S. Willison, “Cross-agent privilege escalation in AI assistants,” Blog, 2025.
[19]. S. Yao et al., “ReAct: Synergizing reasoning and acting in language models,” in ICLR, 2023.
[20]. T. Schick et al., “Toolformer: Language models can teach themselves to use tools,” in NeurIPS, 2023.
[21]. C. Schroeder de Witt et al., “Open challenges in multi-agent security: Towards secure systems of interacting AI agents,” arXiv:2505.02077, 2025.
[22]. Z. Wang et al., “MCP-Bench: Benchmarking tool-using LLM agents with complex real-world tasks via MCP servers,” arXiv:2508.20453, Aug. 2025. [Online]. Available: https://github.com/Accenture/mcp-bench
[23]. Y. Yang, D. Wu, and Y. Chen, “MCPSecBench: A systematic security benchmark and playground for testing Model Context Protocols,” arXiv:2508.13220, Aug. 2025.
[24]. E. Harris, “MCP Security Research,” 2025. [Online]. Available: https://mcpsec.dev/
[25]. Virtue AI, “MCPGuard: First agent-based MCP scanner to protect AI agents,” Aug. 2025. [Online]. Available: https://blog.virtueai.com/2025/08/22/mcpguard-first-agent-based-mcp-scanner-to-protect-ai-agents/
Downloads
Published
How to Cite
Issue
Section
Categories
License
Copyright (c) 2026 Narek Maloyan, Dmitry Namiot
This work is licensed under a Creative Commons Attribution 4.0 International License.
