← Back to Library

Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem

Authors: Shiva Gaire, Srijan Gyawali, Saroj Mishra, Suman Niroula, Dilip Thakur, Umesh Yadav

Published: 2025-12-09

arXiv ID: 2512.08290v1

Added to Library: 2025-12-10 03:01 UTC

Red Teaming

📄 Abstract

The Model Context Protocol (MCP) has emerged as the de facto standard for connecting Large Language Models (LLMs) to external data and tools, effectively functioning as the "USB-C for Agentic AI." While this decoupling of context and execution solves critical interoperability challenges, it introduces a profound new threat landscape where the boundary between epistemic errors (hallucinations) and security breaches (unauthorized actions) dissolves. This Systematization of Knowledge (SoK) aims to provide a comprehensive taxonomy of risks in the MCP ecosystem, distinguishing between adversarial security threats (e.g., indirect prompt injection, tool poisoning) and epistemic safety hazards (e.g., alignment failures in distributed tool delegation). We analyze the structural vulnerabilities of MCP primitives, specifically Resources, Prompts, and Tools, and demonstrate how "context" can be weaponized to trigger unauthorized operations in multi-agent environments. Furthermore, we survey state-of-the-art defenses, ranging from cryptographic provenance (ETDI) to runtime intent verification, and conclude with a roadmap for securing the transition from conversational chatbots to autonomous agentic operating systems.

🔍 Key Points

  • This paper establishes a taxonomy distinguishing between adversarial security threats (e.g., tool poisoning, prompt injection) and epistemic safety hazards (e.g., hallucinations, alignment failures) within the Model Context Protocol (MCP) ecosystem.
  • It analyzes the structural vulnerabilities of MCP primitives (Resources, Prompts, Tools), showing how the decoupling of context from execution creates new risk vectors that can be exploited in multi-agent environments.
  • The authors survey state-of-the-art defenses against these risks, including cryptographic provenance, runtime intent verification, and policy-based access control, providing a roadmap for enhancing security in MCP deployments.
  • The paper presents forensic case studies that illustrate real-world incidents related to MCP vulnerabilities, allowing researchers to extract actionable lessons for future protocol implementations.

💡 Why This Paper Matters

This paper is crucial as it systematically addresses the emerging security and safety challenges posed by the integration of MPC with LLMs, providing a foundational understanding essential for developing secure agent-based protocols in AI systems.

🎯 Why It's Interesting for AI Security Researchers

This research is of significant interest to AI security researchers as it highlights the unique vulnerabilities and attack vectors introduced by the Model Context Protocol, offering novel insights into how these can be mitigated. The in-depth taxonomy and practical implications for improving protocol security enrich ongoing discussions and efforts in the field of AI safety and security.

📚 Read the Full Paper

📄 View on arXiv 📎 Download PDF