Source-linked AI summary
MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol
Huihao Jing, Haoran Li, Wenbin Hu, Qi Hu, Heli Xu, Tianshu Chu, Peizhao Hu, Yangqiu Song
TL;DR
MCP’s separately deployed clients and servers make safety analysis more complex, including judging whether function calls are appropriate in context. The paper proposes MCIP, a safety-enhanced MCP with a risk taxonomy, benchmark, and training data. Its safety-aware model reports improvements on two safety metrics and an additional generalization test.
Problem
Because MCP clients and servers are separately deployed, safety assessment must consider whether functions are called appropriately in context, not only calling accuracy or sensitive privacy leakage.
Source: §1 · pp. 1–2Method
The paper uses MAESTRO to identify missing MCP safety components and proposes MCIP with tracking tools, a guard model, a risk taxonomy, benchmark, and training data.
Source: §1 · p. 2Results
40.81% and 18.3% improvements on two safety metrics, respectively, and 27.22% on an additional generalization test are reported for the safety-aware model.
Source: §1 · p. 2Takeaways & Limitations
MCIP retains MCP’s original functionalities while adding capabilities to locate and defend potential risks.
Source: §1 · p. 2The method does not simulate or enumerate specific adversarial attack strategies.
Source: Limitations · p. 9
Abstract
from arXiv · showhide
As Model Context Protocol (MCP) introduces an easy-to-use ecosystem for users and developers, it also brings underexplored safety risks. Its decentralized architecture, which separates clients and servers, poses unique challenges for systematic safety analysis. This paper proposes a novel framework to enhance MCP safety. Guided by the MAESTRO framework, we first analyze the missing safety mechanisms in MCP, and based on this analysis, we propose the Model Contextual Integrity Protocol (MCIP), a refined version of MCP that addresses these gaps. Next, we develop a fine-grained taxonomy that captures a diverse range of unsafe behaviors observed in MCP scenarios. Building on this taxonomy, we develop benchmark and training data that support the evaluation and improvement of LLMs' capabilities in identifying safety risks within MCP interactions. Leveraging the proposed benchmark and training data, we conduct extensive experiments on state-of-the-art LLMs. The results highlight LLMs' vulnerabilities in MCP interactions and demonstrate that our approach substantially improves their safety performance.
1 Introduction
MCP’s separate client and server create safety challenges that require judging whether function calls are appropriate in context. The paper proposes MCIP, a safety-enhanced MCP with tracking tools and a guard model, and develops a risk taxonomy, benchmark, and training data.
1 Introduction
- MCP’s separately deployed clients and servers make safety analysis more complex than checking calling accuracy or sensitive privacy leakage alone.The paper argues that assessment must consider whether functions are called appropriately within context.Source: §1 · pp. 1–2
- MCIP retains MCP’s original functionalities while adding tracking tools and a guard model to locate and defend potential risks.The paper presents MCIP as a safety-enhanced version of MCP guided by MAESTRO’s identification of missing safety components.Source: §1 · p. 2
- The proposed taxonomy organizes MCP interaction risks across five dimensions and aligns them with MAESTRO.The paper also introduces MCIP-bench and taxonomy-guided training data for assessing and improving LLM risk identification.Source: §1 · p. 2
- 40.81% and 18.3% improvements on two safety metrics, respectively, and 27.22% on an additional generalization test are reported for the safety-aware model.The supplied passage does not name the two safety metrics.Source: §1 · p. 2
2 Preliminaries
The preliminaries situate the work in LLM tool use, multilayered agentic-AI risk analysis, and Contextual Integrity. The paper uses Contextual Integrity’s information-flow concepts to reason about contextually appropriate function calls.
2.1 LLM Tool Use
- Tool-use research covers external data, APIs, and local memory, while recent reliability efforts often depend on predefined scenarios.The cited examples include benchmarks and synthetic-data methods for improving tool-use capabilities.Source: §2.1 · p. 2
2.2 Agentic AI Threat Modeling Framework
- MAESTRO provides a multilayered approach to agentic-AI risk analysis, including vulnerabilities arising within and across layers.Its sixth layer cuts across the others, integrating security and compliance controls across agent operations.Source: §2.2 · p. 2
2.3 Contextual Integrity
- Contextual Integrity models privacy in the context of information flows, and the paper applies its definitions to contextual correctness in function calling.The cited flow formulation specifies sender, subject, information, receiver, and transmission principle; CI also considers the temporal trajectory of flows.Source: §2.3 · pp. 2–3
3 MCIP
MCIP extends MCP with tracking logs and a safety-aware guard model, addressing components identified as missing through MAESTRO-guided analysis. Its tracking format represents interactions as information-flow trajectories, while MCIP Guardian detects and categorizes risks.
3 MCIP
- MCIP adds tracking-log formats and a safety-aware model to address MCP’s missing tracking tools and guardrail.The design follows a mapping of MCP components to MAESTRO layers.Source: §3 · p. 3
3.1 Tracking Log Format
- MCI records each case as an ordered trajectory of five-element information flows, enabling fine-grained tracking and auditing of MCP interactions.Each flow specifies sender, recipient, data subject, information type, and transmission principle.Source: §3.1 · p. 3
3.2 MCIP Guardian
- MCIP Guardian detects unsafe factors and assigns fine-grained risk categories, using a taxonomy, benchmark, and training data to support risk recognition.The proposed components are intended to support a complete attack-defense lifecycle.Source: §3.2 · pp. 3–4
4 Under MCIP: Taxonomy
The taxonomy analyzes MCP safety risks across threat phase, source, scope, type, and corresponding MAESTRO layers. These dimensions help locate risks and distinguish the interaction patterns they affect.
4.1 Threat Phase
- The three threat phases are Config, Termination, and client–server Interaction; configuration risks call for file audits, while interaction risks typically call for log review.Configuration and termination risks include insecure infrastructure and misleading server trust; either client or server may inject instructions during interaction.Source: §4.1 · p. 4
4.2 Threat Source, Threat Type
- Threats can originate from the client’s prompts or function parameters, or from server-provided function lists and returns, helping pinpoint attack source and mechanism.A malicious server may inject instructions to call disruptive functions through legitimate function returns.Source: §4.2 · p. 4
4.3 Threat Scope
- Threat scope distinguishes intra-flow violations of five information-flow elements, missing or redundant single-flow steps, and malicious reordering across flows.For example, accessing data before verification reverses the intended order and may lead to privilege leakage.Source: §4.3 · pp. 4–5
4 Under MCIP: Taxonomy
- The taxonomy organizes MCP risks by phase, source, scope, type, and MAESTRO category, with some risks additionally mapped to Layer 1.Figure 3 presents the taxonomy, with phase in the leftmost column and the other dimensions in the main body.Source: §4.3 · p. 5, Figure 3 · p. 5
5 Taxonomy Guided Data Generation
The section constructs taxonomy-guided data for evaluating MCP safety and training MCIP Guardian. The benchmark uses synthesized risk cases, while the training set represents interactions as structured information flows.
5 Taxonomy Guided Data Generation
- The generated data supports both robustness evaluation in the MCP setting and MCIP Guardian training in an MCI format.The authors describe the benchmark as based on real-world data and the training data as taxonomy-guided.Source: §5 · p. 5
5.2 MCIP-Bench
- MCIP-bench contains 2,218 synthesized instances across 10 risk categories and one safe class, built from 200 sampled conversations and a 10,633-pair function pool.A supplementary ToolACE evaluation set tests generalization to unseen risks and an alternative data source; benchmark instances average around six dialogue turns.Source: §5.2 · p. 6
5.3 Training Data
- MCIP Guardian’s synthetic training set contains 13,830 instances across 11 categories, averaging around eight information-transmission steps per instance.Real-world tracking logs were not yet feasible to collect for validating the tracking approach, so training relies on synthetic data.Source: §5.3 · p. 6
6 Experimental Setups
The experiments assess safety recognition, generalization, utility, and model training conditions. Safety is measured on binary and 11-class tasks, with BFCL-v3 used to assess function-calling utility.
6.1 Evaluation Metrics
- Safety Awareness measures binary safe-versus-unsafe accuracy, while Risk Resistance measures accuracy on 11-class risk identification, including ToolACE generalization to unseen functions.ToolACE Risk Resistance uses functions different from those used during training.Source: §6.1 · p. 7
- BFCL-v3 overall accuracy measures whether MCIP Guardian’s safety-oriented design affects function-calling utility under non-adversarial conditions.The metric is used to assess the trade-off between security robustness and function-calling capability.Source: §6.1 · p. 7
6.2 Training Details.
- Training uses Salesforce/Llama-xLAM-2-8b-fc-r with supervised fine-tuning for three epochs on four NVIDIA H800 80GB GPUs.The reported learning rate is 5 × 10−6, batch size is 2, and maximum sequence length is 2,048.Source: §6.2 · p. 7
7 Experimental Result
The experiments evaluate risk identification in state-of-the-art models and examine vulnerabilities and MCIP Guardian through ablations. Results compare general-purpose and function-calling models across safety and utility, then track Guardian’s training trade-off.
7.1 Overall Performance
- Qwen2.5-32B-Instruct reaches 50.08% Safety Awareness, DeepSeek-R1 67.37%, and xLAM-2-8B-fc-r 13.35% Risk Resistance, illustrating persistent risk-awareness gaps.The authors suggest function-calling models may overapprove benign and adversarial calls.Source: §7.1 · p. 7
- General-reasoning models outperform function-calling-oriented models on Risk Resistance and Safety Awareness; DeepSeek-R1 leads Risk Resistance at 42.28%.DeepSeek-R1 also ranks second on ToolACE Risk Resistance and Safety Awareness.Source: §7.1 · p. 7, Table 2 · p. 8
- Function-calling models score over or near 70% utility but show weaker risk resistance, while MCIP Guardian offers a more balanced safety–utility trade-off.The comparison uses BFCL overall accuracy and Risk Resistance; Guardian raises risk resistance while preserving competitive utility.Source: §7.1 · pp. 7–8, Figure 5 · p. 8
7.2 Ablation Study
- Specialized function-calling training tends to increase approval of function executions while overlooking risks, consistent with a missing signal about when calls are appropriate.Figure 6 reports Safe and Unsafe per-class recall for Safety Awareness and weighted recall across risk categories for Risk Resistance.Source: §7.2 · p. 8, Figure 6 · p. 8
- During MCIP Guardian training, helpfulness initially declines as safety metrics improve; the helpfulness drop is moderate while safety gains are significant.Figure 7 presents performance curves during and beyond the main training phase.Source: §7.2 · p. 8, Figure 7 · p. 8
8 Conclusion
The conclusion presents MCIP as a safety-enhanced MCP framework, pairing risk analysis with tailored evaluation and training resources. The experiments provide empirical findings, while future work targets larger-scale data generation and joint security-functionality alignment.
8 Conclusion
- MCIP formalizes safety mechanisms for MCP, guided by existing safety modeling frameworks.The paper describes it as a more secure variant of the protocol.Source: §8 · p. 9
- The work develops a taxonomy of potential security risks and benchmarks and training data tailored to those risks.The conclusion says these resources support evaluation and training.Source: §8 · p. 9
- Future work will explore large-scale data generation and dual alignment of security and functionality.Source: §8 · p. 9
Limitations
The stated limitations concern concrete attack coverage and remaining weaknesses in risk identification, especially for long-tail risk types.
Limitations
- The method does not simulate or enumerate concrete adversarial strategies, including prompt-injection variants and malicious-payload construction.The taxonomy considers malicious sources and plausible threat goals, but does not explicitly capture the diversity of attack techniques.Source: Limitations · p. 9
- Risk Resistance remains 54.16%, and difficult long-tail risk types still need more sensitive detection.The paper particularly identifies causal dependency injection as challenging to model and constrained by limited data.Source: Limitations · p. 9
- The authors identify adaptive threat modeling and dynamic adversarial training as future directions.Source: Limitations · p. 9
Ethical Considerations
The authors affirm adherence to ACM and ACL ethics codes and present MCP-context risk analysis as complementary to isolated study of LLM agents. The section covers risks across configuration, interaction, and termination phases, including interaction-phase privilege abuse and termination failures involving stale privileges, configuration drift, and version mismatches.
Ethical Considerations
- The authors affirm ACM Code of Ethics and ACL Code of Conduct compliance, use openly licensed datasets and OpenRLHF, and acknowledge that publishing vulnerability findings could aid attackers.They argue that the need for systematic MCP safety analysis justifies sharing the findings in full.Source: Ethical Considerations · p. 9
A.1 Config Phase
- Configuration examples include server-name overlap, spoofed installers that alter constraints, and foundation-model backdoors that can leak data or bypass safety filters.The backdoor risk is mapped to Layer 1 of MAESTRO.Source: §A.1 · p. 13
A.2 Interaction Phase
- Interaction risks include malicious function overlap or excessive privileges, forged dependencies or outputs, altered causal order, and injected intent or return data.These examples show how malicious servers or clients can mislead the LLM into unintended calls or plans, potentially creating security risks.Source: §A.2 · pp. 13–15
- During interaction, identity injection lets a malicious client impersonate privileged users for sensitive or destructive commands, while replay injection reuses one-time privileged authorization without revalidation.The paper describes identity injection as enabling administrator-only commands and replay injection as repeated privileged calls after one-time authorization.Source: §A.2 · p. 15
A.3 Termination Phase
- At termination, risks include privileges not revoked after use or session expiry, malicious servers incrementally changing local MCP settings, and version mismatches that silently skip enforcement or information flows.The passages identify expired privilege redundancy, configuration drift, and server-version mismatch as distinct termination-phase risks.Source: §A.3 · p. 16
B.1 Taxonomy-Guided Data
The supplement describes label distributions across training and benchmark data and outlines how benchmark and training examples are generated. Most data are directly annotated, with targeted function-pool expansion for two attack types.
B.1 Taxonomy-Guided Data
- The supplement reports MCIP-bench label statistics and training-sample counts, while Figure 8 compares label distributions across training and benchmark data.The comparison highlights coverage and imbalance across attack types.Source: §B.1 · p. 16, Figure 8 · p. 16, Table 3 · p. 17
C Generation Details
- Most data are constructed through direct annotation, but Excessive Privileges Overlapping and Identity Injection use DeepSeek-R1-annotated high-privilege functions to expand the function pool.Table 5 shows the prompt template for high-privilege function generation.Source: C Generation Details · p. 16, Table 5 · p. 18
- For training, DeepSeek-R1 annotates original data in MCI format; evaluation data use the Evaluation prompt template.Both templates are included in Table 5.Source: C Generation Details · p. 16, Table 5 · p. 18