CoChat
Sign Up
PreprintCited by 1Adversarial Robustness in Machine LearningWeb Application Security VulnerabilitiesInformation and Cyber Security

MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0)

Open access
Shen, Yi Ting, Toyoda, Kentaroh, Leung, Alex·2026·arXiv
DOI 10.48550/arxiv.2603.18063arXiv 2603.18063
Open this paper in CoChat — free accountOpen PDF

Abstract

The Model Context Protocol (MCP) introduces a structurally distinct attack surface that existing threat frameworks, designed for traditional software systems or generic LLM deployments, do not adequately cover. This paper presents MCP-38, a protocol-specific threat taxonomy consisting of 38 threat categories (MCP-01 through MCP-38). The taxonomy was derived through a systematic four-phase methodology: protocol decomposition, multi-framework cross-mapping, real-world incident synthesis, and remediation-surface categorization. Each category is mapped to STRIDE, OWASP Top 10 for LLM Applications (2025, LLM01--LLM10), and the OWASP Top 10 for Agentic Applications (2026, ASI01--ASI10). MCP-38 addresses critical threats arising from MCP's semantic attack surface (tool description poisoning, indirect prompt injection, parasitic tool chaining, and dynamic trust violations), none of which are adequately captured by prior work. MCP-38 provides the definitional and empirical foundation for automated threat intelligence platforms.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2603.18063

Cites

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The SoK on agentic AI attack surfaces and the MCP-38 threat taxonomy provide comprehensive attack taxonomies but no unified formal defenses.

    “The SoK on agentic AI attack surfaces [28] and the MCP-38 threat taxonomy [29] provide comprehensive attack taxonomies but no unified formal defenses.”

    From SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems (2026) · cites this paper as [29]

Authors
Shen, Y. T., Toyoda, K., & Leung, A.
ORCID
Toyoda, Kentaroh
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2603.18063
arXiv
2603.18063
OpenAlex
W7139931356
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
Model Context Protocol, threat taxonomy, large language models, LLM security, attack surface, prompt injection, breach of trust, threat intelligence, STRIDE

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review