← Back to Library

Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning

Authors: Charoes Huang, Xin Huang, Ngoc Phu Tran, Amin Milani Fard

Published: 2026-03-23

arXiv ID: 2603.22489v1

Added to Library: 2026-03-25 02:02 UTC

Red Teaming

📄 Abstract

The Model Context Protocol (MCP) has rapidly emerged as a universal standard for connecting AI assistants to external tools and data sources. While MCP simplifies integration between AI applications and various services, it introduces significant security vulnerabilities, particularly on the client side. In this work we conduct threat modelings of MCP implementations using STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) and DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) frameworks across five key components: (1) MCP Host and Client, (2) LLM, (3) MCP Server, (4) External Data Stores, and (5) Authorization Server. This comprehensive analysis reveals tool poisoning-where malicious instructions are embedded in tool metadata-as the most prevalent and impactful client-side vulnerability. We therefore focus our empirical evaluation on this critical attack vector, providing a systematic comparison of how seven major MCP clients validate and defend against tool poisoning attacks. Our analysis reveals significant security issues with most tested clients due to insufficient static validation and parameter visibility. We propose a multi-layered defense strategy encompassing static metadata analysis, model decision path tracking, behavioral anomaly detection, and user transparency mechanisms. This research addresses a critical gap in MCP security, which has primarily focused on server-side vulnerabilities, and provides actionable recommendations and mitigation strategies for securing AI agent ecosystems.

🔍 Key Points

  • Application of STRIDE and DREAD frameworks to systematically analyze security threats in the Model Context Protocol (MCP) implementations across five key components.
  • Identification of tool poisoning as the most significant and prevalent client-side vulnerability in MCP security, highlighting the risks of malicious metadata embedded in tools.
  • Empirical assessment of seven major MCP clients, revealing critical weaknesses in client-side validation and parameter visibility, leading to a clear understanding of security postures.
  • Proposing a multi-layered defense strategy that includes static metadata analysis, model decision path tracking, behavioral anomaly detection, and user transparency mechanisms to mitigate security threats.
  • Addressing a critical gap in research that has predominantly focused on server-side vulnerabilities, thus contributing directly to enhancing the security of AI agent ecosystems.

💡 Why This Paper Matters

This paper addresses an urgent and significant issue in AI security by rigorously analyzing vulnerabilities in the Model Context Protocol, particularly on the client side. By focusing on a systematic threat modeling approach and empirical validation of real-world clients, it highlights critical security weaknesses and offers actionable mitigation strategies. The findings emphasize the necessity of securing AI systems as they become more integrated with various external tools and services, making this research highly relevant and a crucial contribution to the field of AI security.

🎯 Why It's Interesting for AI Security Researchers

The paper would be of interest to AI security researchers as it fills a critical research gap by providing empirical evidence of security vulnerabilities specifically in MCP clients, a previously under-explored aspect of AI security. Its rigorous threat modeling and analysis of tool poisoning attacks offer valuable insights into the vulnerabilities present in widely used AI implementations and propose concrete defense strategies. These contributions not only enhance understanding of current risks in AI systems but also guide future research and development of more secure AI applications.

📚 Read the Full Paper

📄 View on arXiv 📎 Download PDF