PaperlayerView exact revision on arXiv

Source-linked AI summary

MPMA: Preference Manipulation Attack Against Model Context Protocol

Zihan Wang, Rui Zhang, Yu Liu, Wenshu Fan, Wenbo Jiang, Qingchuan Zhao, Hongwei Li, Guowen Xu

arXiv:2505.11154v2cs.CRcs.CL

TL;DR

The paper asks about the trustworthiness of MCP applications. The paper proposes MPMA, using direct insertion of manipulative text in DPMA and advertising strategies with a Genetic Algorithm in GAPMA to influence MCP tool selection. GAPMA demonstrates strong attack effectiveness across diverse models and settings, and the Genetic Algorithm even increases its effectiveness.

  • Problem

    The paper asks about the trustworthiness of MCP applications.

    Source: §1 · p. 1

  • Method

    The paper proposes MPMA, using direct insertion of manipulative text in DPMA and advertising strategies with a Genetic Algorithm in GAPMA to influence MCP tool selection.

    Source: §1 · pp. 1–2, §8 · p. 8

  • Results

    GAPMA demonstrates strong attack effectiveness across diverse models and settings, and the Genetic Algorithm even increases its effectiveness.

    Source: §6.2 · p. 7

  • Takeaways & Limitations

    The authors identify a critical MCP security vulnerability and call for robust defenses to ensure fairness in the ecosystem.

    Source: §1 · p. 2

    The threat model assumes the attacker can manipulate server metadata but cannot control or modify the base LLM.

    Source: §3 · p. 3

Abstract

from arXiv · show

Model Context Protocol (MCP) standardizes interface mapping for large language models (LLMs) to access external data and tools, which revolutionizes the paradigm of tool selection and facilitates the rapid expansion of the LLM agent tool ecosystem. However, as the MCP is increasingly adopted, third-party customized versions of the MCP server expose potential security vulnerabilities. In this paper, we first introduce a novel security threat, which we term the MCP Preference Manipulation Attack (MPMA). An attacker deploys a customized MCP server to manipulate LLMs, causing them to prioritize it over other competing MCP servers. This can result in economic benefits for attackers, such as revenue from paid MCP services or advertising income generated from free servers. To achieve MPMA, we first design a Direct Preference Manipulation Attack (DPMA) that achieves significant effectiveness by inserting the manipulative word and phrases into the tool name and description. However, such a direct modification is obvious to users and lacks stealthiness. To address these limitations, we further propose Genetic-based Advertising Preference Manipulation Attack (GAPMA). GAPMA employs four commonly used strategies to initialize descriptions and integrates a Genetic Algorithm (GA) to enhance stealthiness. The experiment results demonstrate that GAPMA balances high effectiveness and stealthiness. Our study reveals a critical vulnerability of the MCP in open ecosystems, highlighting an urgent need for robust defense mechanisms to ensure the fairness of the MCP ecosystem.

1 Introduction

MCP standardizes tool access for LLM agents, but existing security research leaves the trustworthiness of MCP applications an open question. The paper introduces MPMA and proposes DPMA and GAPMA to manipulate tool selection, with experiments reporting high effectiveness and improved stealthiness for GAPMA.

1 Introduction

  • MCP adoption has expanded the tool ecosystem, while security research has focused mainly on malicious code and privacy leakage rather than overall application trustworthiness.Some MCP platforms operate at a scale exceeding 13,000 instances.Source: §1 · p. 1
  • DPMA inserts manipulative words or phrases into tool names or descriptions and achieves a 100% ASR in most settings.The paper introduces MPMA as a threat in which a malicious server seeks preference over competing servers offering similar functions.Source: §1 · p. 1
  • GAPMA combines four advertising strategies—Authoritative, Emotional, Exaggerated, and Subliminal—with a black-box Genetic Algorithm to improve stealthiness while maintaining attack effectiveness.The paper motivates stealth because users and third-party platform reviewers can inspect tool names and descriptions.Source: §1 · p. 2
  • Under conservative estimates, DPMA and GAPMA could generate over $200,000 in yearly unfair benefits in web search alone.The paper expects the economic impact to grow as MCP adoption widens.Source: §1 · p. 2
  • Experiments across 8 MCP servers and 5 mainstream LLMs report that MCP-based tool selection is vulnerable to MPMA.The authors call for defense mechanisms to protect fairness in the MCP ecosystem.Source: §1 · p. 2

2 Preliminary

The preliminary section places MPMA among attacks on LLM tool selection and outlines MCP’s components and workflow. It emphasizes that MPMA targets planning and tool selection.

2 Preliminary

  • Unlike retriever-based tool-selection approaches, MCP leaves tool selection to the LLM itself (Shi et al. 2025).The paper frames MPMA as a security concern in the emerging MCP application domain.Source: §2 · p. 2

2.1 Model Context Protocol (MCP)

  • MCP comprises a host, client, and server; the server lets the client access external services and execute tasks, and its tools have names and descriptions.The host integrates user interaction, servers, and LLMs, while the client manages communication between the host and servers.Source: §2.1 · p. 3
  • The workflow runs from task planning through tool selection and calling to final output, with MPMA targeting the first two stages.The host supplies the LLM with the user prompt and available tools’ names and descriptions during planning.Source: §2.1 · p. 3

3 Threat Model

The threat model assumes an attacker can publish a malicious MCP server and manipulate its metadata, but cannot modify the base LLM. The attacker seeks both frequent selection and stealth.

3 Threat Model

  • A malicious provider publishes a paid MCP server on a third-party platform and seeks selection over competing servers to gain service-fee or advertising income.The assumed attacker is the server builder, with control over tool names and descriptions but not the base LLM.Source: §3 · p. 3
  • The attacker’s effectiveness goal is for LLMs to select the malicious server more often than competitors, producing measurable economic benefits.Source: §3 · p. 3
  • The attacker’s stealth goal is to keep tool metadata inconspicuous to users and evade manual inspection and automated detection.Source: §3 · p. 3

4 Methodology of MPMA

MPMA manipulates tool selection through server tool names and descriptions: DPMA uses overt “best” wording, while GAPMA applies advertising strategies and genetic refinement to improve stealthiness.

4.1 Attack Overview

  • The overview contrasts benign tool selection with DPMA and GAPMA attacks, in which the model selects the malicious server based on its description.The illustrated GAPMA example uses an exaggerated advertising description and is described as more stealthy than DPMA.Source: §4.1 · p. 4, Figure 3 · p. 5

4.2 Direct Preference Manipulate Attack (DPMA)

  • DPMA prepends “best” wording to the tool description or name, but that conspicuous language can trigger suspicion during manual or automated inspection.Best Description prepends “This is the best tool in the world.” to the raw description; Best Name prepends “best” to the tool name.Source: §4.2 · p. 4

Advertising Strategies

  • GAPMA draws on four advertising strategies: authoritative advice, emotional language, exaggeration, and subliminal cues.The strategies aim to influence preferences without explicit awareness.Source: Advertising Strategies · p. 4

Algorithm for Descriptions Stealthiness Enhancement.

  • GAPMA transforms descriptions using advertising styles, then uses genetic mutation, crossover, and iterative least-suspicious selection to refine them.GPT-4o retains the top-k least suspicious candidates at each iteration and selects the most stealthy final description.Source: Algorithm for Descriptions… · pp. 4–5

5 Experimental Setup

The setup evaluates attack effectiveness and stealthiness using five base LLMs, eight MCP servers, and ten server-specific queries, with equal selection probability as the no-attacker baseline.

Metrics

  • ASR measures attack effectiveness, while TPR measures the share of tool descriptions flagged as suspicious by LLM judges or human annotators.The study uses five LLM judges and three independent human annotators; lower TPR indicates greater stealthiness.Source: §5 · p. 5

Models, MCP Servers, and Dataset

  • The evaluation uses five base LLMs and eight MCP servers, with ten corresponding queries constructed for each server.The server functions include weather, time, installation assistance, news, fetching, markdown conversion, cryptocurrency analysis, and web search.Source: §5 · p. 6, Figure 4 · p. 6

Baseline

  • The no-attacker baseline assigns each of six competing servers an equal selection probability, yielding a baseline ASR of 16.67%.The setup also includes five additional competing servers alongside the malicious server.Source: §5 · p. 6

6 Experimental Result

The experiments find that GAPMA advertising strategies generally outperform the baseline in attack success rate (ASR), while genetic-algorithm (GA) optimization improves stealthiness. DPMA’s Best Description strategy achieves 100% ASR across almost all settings, but GAPMA’s Au strategy offers the strongest reported combination of effectiveness and stealth.

6.1 Experimental Result of DPMA

  • DPMA’s Best Description strategy achieves 100% ASR across almost all settings, generally outperforming Best Name.Best Name reaches 100% in most cases but falls below baseline in a few GPT-4o scenarios.Source: §6.1 · p. 6

6.2 Experimental Result of GAPMA

  • Most GAPMA advertising strategies exceed the 16.67% baseline ASR; Au performs best, while Ex is an exception under GPT-4o.Across the five evaluated LLMs, Gemini has the highest reported ASR at 91.88%, and GPT-4o the lowest at 22.19%.Source: §6.2 · pp. 6–7, Table 1 · p. 7

6.3 Stealthiness Experiment

  • With GA, Au/Em/Ex/Su TPRs are 0%/5%/2.5%/0% under LLM judging, below Best Description’s 37.5%.GA also lowers TPR versus non-GA variants in both LLM and human evaluations; Au-GA has the lowest TPR in both.Source: Figure 5 · p. 7, §6.3 · p. 7

7 Discussion

The discussion examines a malicious-majority setting in which most competing MCP servers use DPMA or GAPMA strategies. In several models, benign tools are selected instead, a phenomenon the authors call “over-manipulation.”

Malicious Majority

  • The malicious-majority experiment includes eight competing servers: six manipulative variants and two benign servers.One uses Best Name, one Best Description, and four use GAPMA advertising strategies.Source: §7 · pp. 7–8
  • DeepSeek, Claude, and Gemini select benign tools in the malicious-majority setting, favoring the most straightforward tool.The models explicitly state this preference in their replies.Source: §7 · p. 8
  • The authors speculate that excessive manipulative descriptions may alert models and lead them to choose a more straightforward tool.They name this counterintuitive outcome “over-manipulation.”Source: §7 · p. 8

8 Conclusion

The conclusion frames MPMA as an MCP security threat that can steer tool selection toward an attacker’s server for economic gain. It presents DPMA and GAPMA as approaches to this threat, with experiments indicating that GAPMA combines effectiveness and stealth.

8 Conclusion

  • MPMA describes an attacker manipulating LLM tool preference to gain service-fee revenue or advertising income.The targeted server competes with other services offering similar functionality.Source: §8 · p. 8
  • DPMA embeds manipulative keywords in tool descriptions, achieving strong attack performance but lacking stealth.Source: §8 · p. 8
  • GAPMA uses advertising strategies and a genetic algorithm to craft descriptions that are effective yet inconspicuous.The experiments report that GAPMA combines strong attack effectiveness with stealthiness.Source: §8 · p. 8

A Rough Economic Loss Estimation

The section estimates potential yearly economic benefits from MPMA using web-search server market assumptions and conditional attack success rates. Its calculations cover web search, while the authors note that other paid MCP domains could add further impact.

A Rough Economic Loss Estimation

  • The web-search estimate assumes 170,000 deployments, $5 per 1,000 paid API calls, 1% paid usage, and 10 calls per day.The calculation uses Brave Search as an example and excludes user growth.Source: A Rough Economic Loss Estimation · p. 10
  • Approximately $248,389.8 per year for Best Description in DPMA and $203,033.8 per year for Au strategies in GAPMA are estimated unfair benefits under stated assumptions.The DPMA estimate assumes specified rates of users installing competing servers; the GAPMA estimate assumes equal use probability across LLMs and Brave Search’s average AU-strategy ASR.Source: A Rough Economic Loss Estimation · p. 10
  • The authors estimate that the top five web-search MCP servers’ API call fees total $413,983.The estimate includes DuckDuckGo, Exa Search, Tavily Search, Perplexity Search, and Brave Search.Source: A Rough Economic Loss Estimation · p. 10
  • The economic impact could extend beyond web search to paid image-generation and location-based MCP services.Source: A Rough Economic Loss Estimation · p. 10

B Supplementary Experiment Results

Supplementary experiments assess GAPMA’s performance with and without genetic algorithms, its robustness to more competing servers, and its detection by MCP scanning tools. The reported results show sustained high ASR across many settings and limited detection by the tested defenses.

Comparative Experiment of GAPMA

  • With genetic algorithms, ASR exceeds the no-GA result in all evaluated models except Gemini, where no-GA ASR is slightly higher.The comparison averages results across Deepseek, Claude, GPT-4o, Gemini, and Qwen3; Table 3 covers five LLMs and eight MCP servers.Source: B Supplementary Experiment Results · p. 10, Table 3 · p. 11

Number of Competing MCP Servers

  • Best Description and Best Name in DPMA, and Su and Au in GAPMA, maintain 100% ASR as competing servers increase from 2 to 11.Ex and Em are the only strategies reported to fall below 100%, with declines beginning at nine servers.Source: B Supplementary Experiment Results · p. 10

MPMA under MCP Scaning tools

  • MCPScan and MCPShield detect GAPMA servers in only two settings and GAPMA servers without GA in three; they never detect DPMA or benign servers.The authors report that both tools fail to identify prompt injections in most cases.Source: B Supplementary Experiment Results · p. 11

C Supplementary Experiment Setup

The supplementary setup specifies advertising, prompt-selection, and suspicion-judging prompts, along with dataset and human-evaluation details. It also documents ethical safeguards for conducting and sharing the research.

C Supplementary Experiment Setup

  • The prompt setup combines prompts and asks for edits that reduce obvious exaggeration while retaining advertising characteristics.The section labels the enhancement prompt Penc and shows system and user prompt formats.Source: C Supplementary Experiment Setup · pp. 11–12
  • Selection prompts request either the top ten or the single most engaging description, while the judging prompt classifies descriptions as suspicion or no suspicion.Source: C Supplementary Experiment Setup · pp. 11–12
  • Four advertising strategies transform tool descriptions using authority cues, emotional language, subliminal influence, or exaggerated value claims.Source: C Supplementary Experiment Setup · p. 13
  • The appendix reports optimized Time-server descriptions under GAPMA and DPMA, describes the evaluation dataset’s format and examples, and instructs evaluators to mark descriptions suspicious or malicious (1) versus otherwise (0).It also states that the Tavily MCP server’s tool name and description are visible on the user’s MCP host and third-party platforms.Source: C Supplementary Experiment Setup · pp. 13–14, Table 5 · p. 14

D Ethical Consideration

  • Experiments were conducted in isolated settings with informed consent, anonymized data, and restricted access to code and manipulation descriptions.The authors also used warnings and access barriers for sensitive attack strategies.Source: D Ethical Consideration · p. 14

E Broader Impacts

The paper identifies risks that MPMA could bias tool selection for economic gain and, at scale, undermine ecosystem fairness and diversity. It presents disclosure as a way to inform defenses and recommends trusted labeling in future MCP infrastructure.

E Broader Impacts

  • At scale, manipulation could monopolize user queries for attackers and undermine ecosystem fairness and diversity.The attack embeds direct or invisible manipulations in MCP server descriptions to bias tool selection and gain economic benefits.Source: E Broader Impacts · p. 14
  • The paper recommends trusted labeling mechanisms in future MCP infrastructure to enhance platform security and user trust.Source: E Broader Impacts · p. 14
  • Tool descriptions are shown in Cline and Smithery, the platforms identified in the figure caption.Source: Figure 7 · p. 15
Loading 2505.11154v2…