CoChat
Sign Up
PreprintCited by 43Information and Cyber SecurityAccess Control and TrustAdversarial Robustness in Machine Learning

Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions

Open access
Hou, Xinyi, Zhao, Yanjie, Wang, Shenao, Wang, Haoyu·2025·arXiv
DOI 10.48550/arxiv.2503.23278arXiv 2503.23278
Open this paper in CoChat — free accountOpen PDF

Abstract

The Model Context Protocol (MCP) is an emerging open standard that defines a unified, bi-directional communication and dynamic discovery protocol between AI models and external tools or resources, aiming to enhance interoperability and reduce fragmentation across diverse systems. This paper presents a systematic study of MCP from both architectural and security perspectives. We first define the full lifecycle of an MCP server, comprising four phases (creation, deployment, operation, and maintenance), further decomposed into 16 key activities that capture its functional evolution. Building on this lifecycle analysis, we construct a comprehensive threat taxonomy that categorizes security and privacy risks across four major attacker types: malicious developers, external attackers, malicious users, and security flaws, encompassing 16 distinct threat scenarios. To validate these risks, we develop and analyze real-world case studies that demonstrate concrete attack surfaces and vulnerability manifestations within MCP implementations. Based on these findings, the paper proposes a set of fine-grained, actionable security safeguards tailored to each lifecycle phase and threat category, offering practical guidance for secure MCP adoption. We also analyze the current MCP landscape, covering industry adoption, integration patterns, and supporting tools, to identify its technological strengths as well as existing limitations that constrain broader deployment. Finally, we outline future research and development directions aimed at strengthening MCP's standardization, trust boundaries, and sustainable growth within the evolving ecosystem of tool-augmented AI systems.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2503.23278

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 36

  1. [6][6] Manish Bhatt, Vineeth Sai Narajala, and Idan Habler. 2025. ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by Using OAuth-Enhanced Tool Definitions and Policy-Based Access Control. arXiv preprint arXiv:2506.01333 (2025). https://arxiv.org/abs/2506.01333 - · arXiv
  2. [5][5] Baidu. 2025. Baidu Create 2025 Developer Conference Establishes MCP Ecosystem Forum . Baidu Inc. https://www.aibase. com/news/17525 -
  3. [7][7] Ivo Brett. 2025. Simplified and Secure MCP Gateways for Enterprise AI Integration. arXiv preprint arXiv:2504.19997 (2025). https://arxiv.org/abs/2504.19997 - · arXiv
  4. [9][9] Jizhou Chen and Samuel Lee Cong. 2025. AgentGuard: Repurposing Agentic Orchestrator for Safety Evaluation of Tool Orchestration. CoRR abs/2502.09809 (2025). https://doi.org/10.48550/ARXIV.2502.09809 arXiv:2502.09809 - · DOI
  5. [10][10] Zhi-Yuan Chen, Shiqi Shen, Guangyao Shen, Gong Zhi, Xu Chen, and Yankai Lin. 2024. Towards Tool Use Alignment of Large Language Models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing . 1382-1400. -
  6. [18][18] Florin Cuconasu, Giovanni Trappolini, Federico Siciliano, Simone Filice, Cesare Campagnano, Yoelle Maarek, Nicola Tonellotto, and Fabrizio Silvestri. 2024. The Power of Noise: Redefining Retrieval for RAG Systems. CoRR abs/2401.14887 (2024). https://doi.org/10.48550/ARXIV.2401.14887 arXiv:2401.14887 - · DOI
  7. [21][21] Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. 2024. AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathways. CoRR abs/2406.02630 (2024). https://doi.org/10.48550/ARXIV.2406.02630 arXiv:2406.02630 - · DOI
  8. [24][24] Wenqi Fan, Yujuan Ding, Liangbo Ning, Shijie Wang, Hengyun Li, Dawei Yin, Tat-Seng Chua, and Qing Li. 2024. A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Models. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2024, Barcelona, Spain, August 25-29, 2024 , Ricardo Baeza-Yates and Francesco Bonchi (Eds.). ACM, 6491-6501. https://doi.org/10.1145/3637528.3671470 - · DOI · Paper page
  9. [26][26] Yuyou Gan, Yong Yang, Zhe Ma, Ping He, Rui Zeng, Yiming Wang, Qingming Li, Chunyi Zhou, Songze Li, Ting Wang, Yunjun Gao, Yingcai Wu, and Shouling Ji. 2024. Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents. CoRR abs/2411.09523 (2024). https://doi.org/10.48550/ARXIV.2411.09523 arXiv:2411.09523 - · DOI · Paper page
  10. [25][25] Xiaohan Fu, Shuheng Li, Zihan Wang, Yihao Liu, Rajesh K. Gupta, Taylor Berg-Kirkpatrick, and Earlence Fernandes. 2024. Imprompter: Tricking LLM Agents into Improper Tool Use. CoRR abs/2410.14923 (2024). https://doi.org/10. 48550/ARXIV.2410.14923 arXiv:2410.14923 - · arXiv
  11. [30][30] Nadeeshaan Gunasinghe and Nipuna Marcus. 2021. Language Server Protocol and Implementation . Springer. -
  12. [32][32] Shijue Huang, Wanjun Zhong, Jianqiao Lu, Qi Zhu, Jiahui Gao, Weiwen Liu, Yutai Hou, Xingshan Zeng, Yasheng Wang, Lifeng Shang, Xin Jiang, Ruifeng Xu, and Qun Liu. 2024. Planning, Creation, Usage: Benchmarking LLMs for Comprehensive Tool Utilization in Real-World Complex Scenarios. CoRR abs/2401.17167 (2024). https://doi.org/10. 48550/ARXIV.2401.17167 arXiv:2401.17167 - · arXiv
  13. [31][31] Mohammed Mehedi Hasan, Hao Li, Emad Fallahzadeh, Gopi Krishnan Rajbahadur, Bram Adams, and Ahmed E. Hassan. 2025. Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers. arXiv preprint arXiv:2506.13538 (2025). https://arxiv.org/abs/2506.13538 - · arXiv
  14. [35][35] Sonu Kumar, Anubhav Girdhar, Ritesh Patil, and Divyansh Tripathi. 2025. MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI System. arXiv preprint arXiv:2504.12757 (2025). https://arxiv.org/abs/2504.12757 - · arXiv
  15. [34][34] Sotiropoulos John, Rosario Ron F Del, Kokuykin Evgeniy, Oakley Helen, Habler Idan, Underkoffler Kayla, Huang Ken, Steffensen Peter, Aralimatti Rakshith, Bitton Ron, et al. 2025. OWASP Top 10 for LLM Apps & Gen AI Agentic Security Initiative . Ph. D. Dissertation. OWASP. -
  16. [37][37] Xinzhe Li. 2025. A Review of Prominent Paradigms for LLM-Based Agents: Tool Use, Planning (Including RAG), and Feedback Learning. In Proceedings of the 31st International Conference on Computational Linguistics, COLING 2025, Abu Dhabi, UAE, January 19-24, 2025 , Owen Rambow, Leo Wanner, Marianna Apidianaki, Hend Al-Khalifa, Barbara Di Eugenio, and Steven Schockaert (Eds.). Association for Computational Linguistics, 9760-9779. https: //aclanthology.org/2025.coling-main.652/ -
  17. [40][40] Jiarui Lu, Thomas Holleis, Yizhe Zhang, Bernhard Aumayer, Feng Nan, Felix Bai, Shuang Ma, Shen Ma, Mengyu Li, Guoli Yin, Zirui Wang, and Ruoming Pang. 2024. ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilities. CoRR abs/2408.04682 (2024). https://doi.org/10.48550/ARXIV.2408.04682 arXiv:2408.04682 - · DOI · Paper page
  18. [46][46] Ivan Milev, Mislav Balunović, Maximilian Baader, and Martin Vechev. 2025. ToolFuzz-Automated Agent Tool Testing. arXiv preprint arXiv:2503.04479 (2025). - · arXiv
  19. [54][54] Brandon Radosevich and John Halloran. 2025. MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits. arXiv preprint arXiv:2504.03767 (2025). https://arxiv.org/abs/2504.03767 - · arXiv
  20. [56][56] Zhuocheng Shen. 2024. LLM With Tools: A Survey. CoRR abs/2409.18807 (2024). https://doi.org/10.48550/ARXIV.2409. 18807 arXiv:2409.18807 - · DOI
  21. [57][57] Zhengliang Shi, Shen Gao, Xiuyi Chen, Yue Feng, Lingyong Yan, Haibo Shi, Dawei Yin, Zhumin Chen, Suzan Verberne, and Zhaochun Ren. 2024. Chain of Tools: Large Language Model is an Automatic Multi-tool Learner. CoRR abs/2405.16533 (2024). https://doi.org/10.48550/ARXIV.2405.16533 arXiv:2405.16533 - · DOI
  22. [58][58] Zhengliang Shi, Shen Gao, Lingyong Yan, Yue Feng, Xiuyi Chen, Zhumin Chen, Dawei Yin, Suzan Verberne, and Zhaochun Ren. 2025. Tool Learning in the Wild: Empowering Language Models as Automatic Tool Agents. In THE WEB CONFERENCE 2025 . https://openreview.net/forum?id=T4wMdeFEjX -
  23. [66][66] Zihan Wang, Hongwei Li, Rui Zhang, Yu Liu, Wenbo Jiang, Wenshu Fan, Qingchuan Zhao, and Guowen Xu. 2025. MPMA: Preference Manipulation Attack Against Model Context Protocol. arXiv:2505.11154 [cs.CR] https://arxiv.org/ abs/2505.11154 - · arXiv
  24. [67][67] Zihan Wang, Hongwei Li, Rui Zhang, Yu Liu, Wenbo Jiang, Wenshu Fan, Qingchuan Zhao, and Guowen Xu. 2025. MPMA: Preference Manipulation Attack Against Model Context Protocol. arXiv preprint arXiv:2505.11154 (2025). https://arxiv.org/abs/2505.11154 - · arXiv
  25. [68][68] Georg Wölflein, Dyke Ferber, Daniel Truhn, Ognjen Arandjelovic, and Jakob Nikolas Kather. 2025. LLM Agents Making Agent Tools. CoRR abs/2502.11705 (2025). https://doi.org/10.48550/ARXIV.2502.11705 arXiv:2502.11705 - · DOI · Paper page
  26. [70][70] Zhiheng Xi, Wenxiang Chen, Xin Guo, Wei He, Yiwen Ding, Boyang Hong, Ming Zhang, Junzhe Wang, Senjie Jin, Enyu Zhou, Rui Zheng, Xiaoran Fan, Xiao Wang, Limao Xiong, Yuhao Zhou, Weiran Wang, Changhao Jiang, Yicheng Zou, Xiangyang Liu, Zhangyue Yin, Shihan Dou, Rongxiang Weng, Wensen Cheng, Qi Zhang, Wenjuan Qin, Yongyan Zheng, Xipeng Qiu, Xuanjing Huang, and Tao Gui. 2023. The Rise and Potential of Large Language Model Based Agents: A Survey. CoRR abs/2309.07864 (2023). https://doi.org/10.48550/ARXIV.2309.07864 arXiv:2309.07864 - · DOI · Paper page
  27. [69][69] Shirley Wu, Shiyu Zhao, Qian Huang, Kexin Huang, Michihiro Yasunaga, Kaidi Cao, Vassilis N. Ioannidis, Karthik Subbian, Jure Leskovec, and James Y. Zou. 2024. AvaTaR: Optimizing LLM Agents for Tool Usage via Contrastive Reasoning. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024 , Amir Globersons, Lester Mackey, Danielle Belgrave, Angela Fan, Ulrich Paquet, Jakub M. Tomczak, and Cheng Zhang (Eds.). http://papers.nips.cc/paper\_files/ paper/2024/hash/2db8ce969b000fe0b3fb172490c33ce8-Abstract-Conference.html -
  28. [71][71] Wenpeng Xing, Zhonghao Qi, Yupeng Qin, Yilin Li, Caini Chang, Jiahui Yu, Changting Lin, Zhenzhen Xie, and Meng Han. 2025. MCP-Guard: A Defense Framework for Model Context Protocol Integrity in Large Language Model Applications. arXiv preprint arXiv:2508.10991 (2025). https://arxiv.org/abs/2508.10991 - · arXiv
  29. [73][73] Yixuan Yang, Daoyuan Wu, and Yufan Chen. 2025. MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols. arXiv preprint arXiv:2508.13220 (2025). https://arxiv.org/abs/2508.13220 - · arXiv
  30. [72][72] Konstantin Yakovlev, Sergey I. Nikolenko, and Andrey Bout. 2024. Toolken+: Improving LLM Tool Usage with Reranking and a Reject Option. CoRR abs/2410.12004 (2024). https://doi.org/10.48550/ARXIV.2410.12004 arXiv:2410.12004 - · DOI
  31. [74][74] Junjie Ye, Sixian Li, Guanyu Li, Caishuang Huang, Songyang Gao, Yilong Wu, Qi Zhang, Tao Gui, and Xuanjing Huang. 2024. ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stages. CoRR abs/2402.10753 (2024). https://doi.org/10.48550/ARXIV.2402.10753 arXiv:2402.10753 - · DOI
  32. [76][76] Siyu Yuan, Kaitao Song, Jiangjie Chen, Xu Tan, Yongliang Shen, Kan Ren, Dongsheng Li, and Deqing Yang. 2024. EASYTOOL: Enhancing LLM-based Agents with Concise Tool Instruction. CoRR abs/2401.06201 (2024). https: //doi.org/10.48550/ARXIV.2401.06201 arXiv:2401.06201 - · DOI · Paper page
  33. [75][75] Miao Yu, Fanci Meng, Xinyun Zhou, Shilong Wang, Junyuan Mao, Linsey Pang, Tianlong Chen, Kun Wang, Xinfeng Li, Yongfeng Zhang, et al. 2025. A Survey on Trustworthy LLM Agents: Threats and Countermeasures. arXiv preprint arXiv:2503.09648 (2025). - · arXiv
  34. [79][79] Weibo Zhao, Jiahao Liu, Bonan Ruan, Shaofei Li, and Zhenkai Liang. 2025. When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation. arXiv preprint arXiv:2509.24272 (2025). https://arxiv.org/abs/2509.24272 - · arXiv
  35. [78][78] Shuli Zhao, Qingsheng Hou, Zihan Zhan, Yanhao Wang, Yuchong Xie, Yu Guo, Libo Chen, Shenghong Li, and Zhi Xue. 2025. Mind Your Server: A Systematic Study of Parasitic Toolchain Attacks on the MCP Ecosystem. arXiv preprint arXiv:2509.06572 (2025). https://arxiv.org/abs/2509.06572 - · arXiv
  36. [80][80] Yanjie Zhao, Xinyi Hou, Shenao Wang, and Haoyu Wang. 2024. LLM App Store Analysis: A Vision and Roadmap. CoRR abs/2404.12737 (2024). https://doi.org/10.48550/ARXIV.2404.12737 arXiv:2404.12737 · DOI

Cited by

Sorted by citations

Authors
Hou, X., Zhao, Y., Wang, S., & Wang, H.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2025
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2503.23278
arXiv
2503.23278
OpenAlex
W4417069007
Cited by
43
References
0
Citations by year
2026: 28 · 2025: 15
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
  • Open Research Knowledge Graph (ORKG)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
Model Context Protocol, large language models, security threats, prompt engineering, LLM security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review