Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
Open accessAbstract
The Model Context Protocol (MCP) is an emerging open standard that defines a unified, bi-directional communication and dynamic discovery protocol between AI models and external tools or resources, aiming to enhance interoperability and reduce fragmentation across diverse systems. This paper conducts a systematic study of MCP from both architectural and security perspectives. We first define the full lifecycle of an MCP server, comprising four phases (creation, deployment, operation, and maintenance), further decomposed into 16 key activities that capture its functional evolution. Building on this lifecycle analysis, we construct a comprehensive threat taxonomy that categorizes security and privacy risks across four major attacker types: malicious developers, external attackers, malicious users, and security flaws, encompassing 16 distinct threat scenarios. To validate these risks, we develop and analyze real-world case studies that demonstrate concrete attack surfaces and vulnerability manifestations within MCP implementations. Based on these findings, the paper proposes a set of fine-grained, actionable security safeguards tailored to each lifecycle phase and threat category, offering practical guidance for secure MCP adoption. We also analyze the current MCP landscape, covering industry adoption, integration patterns, and supporting tools, to identify its technological strengths as well as existing limitations that constrain broader deployment. Finally, we outline future research and development directions aimed at strengthening MCP’s standardization, trust boundaries, and sustainable growth within the evolving ecosystem of tool-augmented AI systems. All collected data and implementation examples are publicly available at https://github.com/security-pride/MCP_Landscape .
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The proposed Model Context Protocol (MCP) mediates agent access to external data with fine-grained security rules, acting as an intelligent broker that filters queries and enforces policies.
“for instance, the proposed Model Context Protocol (MCP) mediates agent access to external data with fine-grained security rules, acting as an intelligent broker that filters queries and enforces policies [52,53,64].”
From A Review of Multi-Agent AI Systems for Biological and Clinical Data Analysis (2026) · cites this paper as [53]
MCP accommodates stateful tools such as Prolog: across a sequence of calls, an agent can assert clauses, inspect program state, issue queries, receive structured diagnostics, and refine the formalization.
“MCP also accommodates stateful tools such as Prolog: across a sequence of calls, an agent can assert clauses, inspect program state, issue queries, receive structured diagnostics, and refine the formalization.”
From PrologMCP: A Standardized Prolog Tool Interface for LLM Agents (2026) · cites this paper as [30]
The Model Context Protocol provides a standard interface for exposing tools to LLM agents, with conventions for tool discovery, typed argument schemas, and structured error reporting.
“The Model Context Protocol [29, 30] provides a standard interface for exposing tools to LLM agents, with conventions for tool discovery, typed argument schemas, and structured error reporting.”
From PrologMCP: A Standardized Prolog Tool Interface for LLM Agents (2026) · cites this paper as [30]
Cites
The Rise and Potential of Large Language Model Based Agents: A Survey
Xi, Z., Chen, W., Guo, X., He, W., Ding, Y., Hong, B., Zhang, M., Wang, J., Jin, S., Zhou, E., et al. (2023) · arXiv · doi:10.48550/arxiv.2309.07864 · Cited by 972 · see citing works
A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Models
Fan, W., Ding, Y., Ning, L., Wang, S., Li, H., Yin, D., Chua, T.-S., & Li, Q. (2024) · Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining · doi:10.1145/3637528.3671470 · Cited by 827 · see citing works
Self-citationThe power of noise: Redefining retrieval for rag systems
Cuconasu, F., Trappolini, G., Siciliano, F., Filice, S., Campagnano, C., Maarek, Y., Tonellotto, N., & Silvestri, F. (2024) · Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval · doi:10.1145/3626772.3657834 · Cited by 236 · see citing works
AI agents under threat: A survey of key security challenges and future pathways
Deng, Z., Guo, Y., Han, C., Ma, W., Xiong, J., Wen, S., & Xiang, Y. (2025) · ACM Computing Surveys · doi:10.1145/3716628 · Cited by 210 · see citing works
Huang, S., Zhong, W., Lu, J., et al. (2024) · Annual Meeting of the Association for Computational Linguistics · doi:10.48550/arxiv.2401.17167 · Cited by 105 · see citing works
ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three StagesPreprint
Ye, J., Li, S.-X., Li, G.-Y., Huang, C.-S., Gao, S., Wu, Y., Zhang, Q., Gui, T., & Huang, X.-J. (2024) · Annual Meeting of the Association for Computational Linguistics · doi:10.48550/arxiv.2402.10753 · Cited by 102 · see citing works
Imprompter: Tricking LLM Agents into Improper Tool UsePreprint
Fu, X.-H., Li, S., Wang, Z., Liu, Y.-H., Gupta, R. K., Berg-Kirkpatrick, T., & Fernandes, E. (2024) · arXiv.org · doi:10.48550/arxiv.2410.14923 · Cited by 88 · see citing works
MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context ProtocolsPreprint
Yang, Y.-X., Gao, C.-F., Wu, D.-Y., Chen, Y., Li, Y., & Wang, S. (2025) · arXiv.org · doi:10.48550/arxiv.2508.13220 · Cited by 74 · see citing works
Self-citationA Survey on Trustworthy LLM Agents: Threats and Countermeasures
Yu, M., Meng, F., Zhou, X., Wang, S., Mao, J., Pang, L., Chen, T., Wang, K., Li, X., Zhang, Y., et al. (2025) · arXiv · doi:10.48550/arxiv.2503.09648 · Cited by 34 · see citing works
Self-citationHasan, M. M., Li, H., Fallahzadeh, E., et al. (2026) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3814959 · Cited by 17 · see citing works
Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents
Gan, Y., Yang, Y., Ma, Z., He, P., Zeng, R., Wang, Y., Li, Q., Zhou, C., Li, S., Wang, T., et al. (2024) · arXiv · doi:10.48550/arxiv.2411.09523 · Cited by 8 · see citing works
Towards Tool Use Alignment of Large Language Models
Chen, Z., Shen, S., Shen, G., Gong, Z., Chen, X., & Lin, Y. (2024) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2024.emnlp-main.82 · Cited by 7 · see citing works
Chain of Tools: Large Language Model is an Automatic Multi-tool LearnerPreprint
Shi, Z., Gao, S., Chen, X., Feng, Y., Yan, L., Shi, H., Yin, D., Chen, Z., Verberne, S., & Ren, Z. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2405.16533 · Cited by 6 · see citing works
EASYTOOL: Enhancing LLM-based Agents with Concise Tool Instruction
Yuan, S., Song, K., Chen, J., Tan, X., Shen, Y., Kan, R., Li, D., & Yang, D. (2024) · arXiv · doi:10.48550/arxiv.2401.06201 · Cited by 4 · see citing works
LLM App Store Analysis: A Vision and RoadmapPreprint
Zhao, Y., Hou, X., Wang, S., et al. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2404.12737 · Cited by 3 · see citing works
Self-citationLLM With Tools: A SurveyPreprint
Shen, Z. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2409.18807 · Cited by 3 · see citing works
AgentGuard: Repurposing Agentic Orchestrator for Safety Evaluation of Tool OrchestrationPreprint
Chen, J. L., & Cong, S. L. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2502.09809 · Cited by 3 · see citing works
Wölflein, G., Ferber, D., Truhn, D., Arandjelović, O., & Kather, J. N. (2025) · arXiv · doi:10.48550/arxiv.2502.11705 · Cited by 3 · see citing works
Lu, J., Holleis, T., Zhang, Y., Aumayer, B., Nan, F., Bai, F., Ma, S., Ma, S., Li, M., Yin, G., et al. (2024) · arXiv · doi:10.48550/arxiv.2408.04682 · Cited by 2 · see citing works
Toolken+: Improving LLM Tool Usage with Reranking and a Reject OptionPreprint
Yakovlev, K., Nikolenko, S., & Bout, A. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2410.12004 · Cited by 1 · see citing works
Bhatt, M., Narajala, V. S., & Habler, I. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2506.01333 · Cited by 1 · see citing works
Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem
Zhao, S., Hou, Q., Zhan, Z., et al. (2026) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp63933.2026.00154 · Cited by 1 · see citing works
When MCP Servers Attack: Taxonomy, Feasibility, and MitigationPreprint
Zhao, W., Liu, J., Ruan, B., et al. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2509.24272 · Cited by 1 · see citing works
MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security ExploitsPreprint
Radosevich, B., & Halloran, J. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2504.03767 · Cited by 1 · see citing works
Simplified and Secure MCP Gateways for Enterprise AI IntegrationPreprint
Brett, I. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2504.19997 · Cited by 1 · see citing works
MPMA: Preference Manipulation Attack Against Model Context ProtocolPreprint
Wang, Z., Zhang, R., Liu, Y., et al. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2505.11154 · Cited by 1 · see citing works
MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI SystemPreprint
Kumar, S., Girdhar, A., Patil, R., et al. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2504.12757 · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering
Zhou, C., Chai, H., Chen, W., Guo, Z., Shan, R., Song, Y., Xu, T., Yang, Y., Yu, A., Zhang, W., et al. (2026) · arXiv · doi:10.48550/arxiv.2604.08224 · Cited by 1 · see citing works
Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
de Witt, C. S., Krawiecka, K., Krawczuk, I., Hagag, B., Anderson, W. L., Belcak, P., Bucknall, B., Cai, X., Chopra, A., Cohen, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2505.02077 · Cited by 2 · see citing works
A Review of Multi-Agent AI Systems for Biological and Clinical Data Analysis
Spieser, J., Balapour, A., Meller, J., Patra, K. C., & Shamsaei, B. (2026) · Methods and Protocols · doi:10.3390/mps9020033 · Cited by 1 · see citing works
“There are early efforts to address these issues; for instance, the proposed Model Context Protocol (MCP) mediates agent access to external data with fine-grained security rules, acting as an intelligent broker that filters queries and enforces policies [52,53,64].”
PrologMCP: A Standardized Prolog Tool Interface for LLM Agents
Mensfelt, A., Prabhakaran, A., Haret, A., Trencsenyi, V., & Stathis, K. (2026) · arXiv · doi:10.48550/arxiv.2606.14935 · Cited by 1 · see citing works
Ning, X., Tieu, K., Fu, D., Wei, T., Li, Z., Bei, Y., Zou, J., Ai, M., Liu, Z., Li, T.-W., et al. (2026) · arXiv · doi:10.48550/arxiv.2605.18747
Self-citation
- Authors
- Hou, X., Zhao, Y., Wang, S., & Wang, H.
- Affiliations
- Huazhong University of Science and Technology (CN)
- Venue
- ACM Transactions on Software Engineering and Methodology
- Published
- 2026-09-16
- Volume
- 35
- Issue
- 10
- Pages
- 1-37
- ISSN
- 1049-331X (ISSN-L)
- 1557-7392
- OpenAlex
- W7129030749
- Cited by
- 167
- References
- 27
- Citations by year
- 2026: 156 · 2025: 11
- FWCI
- 523.82
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- ACM Transactions on Software Engineering and Methodology (publishedVersion, cc-by-nd)
- Funders
- National Natural Science Foundation of China (62572209, 62502168)
- Hubei Provincial Key Research and Development Program (2025BAB057)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Keywords
- Model Context Protocol, AI model security, threat taxonomy, security measures, attack surface, privacy risks, open standards
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
