Source-linked AI summary
MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security
Yongjian Guo, Puzhuo Liu, Wanlun Ma, Zehang Deng, Xiaogang Zhu, Peng Di, Xi Xiao, Sheng Wen
TL;DR
Research on MCP security remains fragmented, while MCP agents can be manipulated through tool descriptions, files, and external data treated as instructions. MCPXKIT organizes 31 attack types and evaluates their efficacy, with experiments identifying concrete weaknesses in agent behavior.
Problem
MCP security research remains fragmented, with simplified attack settings, inconsistent terminology, and limited practical validation of threats to MCP agents.
Source: §I · p. 1, §II · p. 3Method
MCPXKIT categorizes 31 MCP attack types into four categories, implements attacks in a plugin-based toolkit, and quantitatively analyzes attack efficacy.
Source: §I · p. 2, §VI · p. 10Results
Experiments identify agents’ reliance on tool descriptions, greater susceptibility to file-based attacks, and difficulty distinguishing external data from executable instructions.
Source: §I · p. 2Takeaways & Limitations
MCPXKIT’s attack examples and empirical findings provide practical references and guidance for MCP security defenses and system design.
Source: §I · p. 2
Abstract
from arXiv · showhide
The Model Context Protocol (MCP) has emerged as a universal standard that enables AI agents to seamlessly connect with external tools, significantly enhancing their functionality. However, while MCP brings notable benefits, it also introduces significant vulnerabilities, such as Tool Poisoning Attacks (TPA), where hidden malicious instructions exploit the sycophancy of large language models (LLMs) to manipulate agent behavior. Despite these risks, current academic research on MCP security remains limited, with most studies focusing on narrow or qualitative analyses that fail to capture the diversity of real-world threats. To address this gap, we present the MCP eXploit Toolkit (MCPXKIT), which categorizes and implements 31 distinct attack methods under four key classifications: direct tool injection, indirect tool injection, malicious user attacks, and LLM inherent attack. We further conduct a quantitative analysis of the efficacy of each attack. Our experiments reveal key insights into MCP vulnerabilities, including agents' blind reliance on tool descriptions, sensitivity to file-based attacks, chain attacks exploiting shared context, and difficulty distinguishing external data from executable commands. These insights, validated through attack experiments, underscore the urgency for robust defense strategies and informed MCP design. Our contributions include 1) constructing a comprehensive MCP attack taxonomy, 2) introducing a unified attack framework, MCPXKIT, and 3) conducting empirical vulnerability analysis to enhance MCP security mechanisms. This work provides a foundational framework, supporting the secure evolution of MCP ecosystems.
I. INTRODUCTION
MCP standardizes how AI agents connect to external tools, but shared context, pre-authorized tools, and trust in tool descriptions expose agents to diverse attacks. MCPXKIT organizes 31 attack types, implements attack simulations, and analyzes their efficacy and underlying weaknesses.
I. INTRODUCTION
- MCP agents may execute unauthorized operations because hidden instructions in tool descriptions are visible to models but not users.Such operations can include reading sensitive files or leaking private data.Source: §I · p. 1
- Academic MCP security research remains limited, often narrow or conceptual, while MCP’s shared context and indirect invocation diversify attack scenarios.Prior studies include narrow attack analyses and theoretical work without practical exploit implementations.Source: §I · p. 1
- MCPXKIT organizes 31 MCP attack types into four categories and quantitatively analyzes their efficacy.The categories are direct tool injection, indirect tool injection, malicious user attacks, and LLM inherent attacks.Source: §I · p. 2
- File-based attacks may succeed more often because file operations can proceed without confirmation, unlike malicious code execution, which typically requires approval.Payloads embedded in benign files may later run in misleading contexts.Source: §I · p. 2
- Agents often prioritize tool descriptions over actual functionality, enabling misleading descriptions to override or circumvent benign behavior.Ambiguous descriptions may also lead to unintended or harmful tool use.Source: §I · p. 2
- Shared context lets attackers use third-party tools or outputs to inject data that agents may treat as executable instructions.The paper also describes contextual tool repair as an opening for coordinated multi-tool attacks.Source: §I · p. 2
- The toolkit combines a plugin-based attack framework with empirical vulnerability analysis intended to inform MCP defenses and system design.The paper presents the framework as extensible and its attack simulations as validated through experiments.Source: §I · p. 2
II. MCP ATTACK TAXONOMY
The paper motivates a structured MCP attack taxonomy by identifying simplified environments, inconsistent terminology, and limited practical validation in prior work. It classifies 31 attack types across four categories grounded in MCP’s architecture and interaction model.
II. MCP ATTACK TAXONOMY
- The taxonomy is grounded in MCP’s technical architecture and interaction model and integrates insights from academic literature and real-world incidents.Tools are universally supported in the cited client context, while Resources and Prompt are unsupported in clients such as Cursor.Source: §II · pp. 2–3
- Prior MCP security work is constrained by simplified attack environments, inconsistent terminology, and limited practical validation.The paper argues for a systematic, case-driven analysis to address these gaps.Source: §II · p. 3
- The taxonomy groups attacks into direct tool injection, indirect tool injection, malicious user attacks, and LLM inherent attacks.The categories distinguish attacks on tools, attacks propagated through dependencies or external data, user-driven attacks, and vulnerabilities inherited from LLMs.Source: §II · p. 3
- The classification covers 31 attack types across single-tool, multi-tool, and diverse attack scenarios.The paper says later sections present technical implementations and empirical examples.Source: §II · p. 3
III. MCP EXPLOIT TOOLKIT: MCPXKIT
MCPXKIT integrates attack examples into a modular, plugin-based framework that simulates malicious server and host entry points and supports indirect injection through varied resource data.
III. MCP EXPLOIT TOOLKIT: MCPXKIT
- MCPXKIT simulates malicious MCP Server and Host entrances using extensible malicious-tool plugins and resource-layer data sources.Resource media include web pages, JSON documents, SQL databases, and GitHub repositories; prompt templates cover malicious-user and LLM-inherent attacks.Source: §III · p. 4
A. Direct Tool Injection Attack
Direct tool injection places malicious instructions in tool descriptions or __doc__ attributes. Attacks range from single-tool file and code operations to coordinated manipulation across tools.
A. Direct Tool Injection Attack
- Direct tool injection embeds malicious instructions in tool descriptions or __doc__ attributes to control an MCP Server.The paper divides this category by impact scope into single-tool and multi-tool influence attacks.Source: A. Direct Tool Injection Attack · p. 4
1) Single Tool Attack :
- Single-tool attacks use one malicious tool without affecting other benign tools and can modify, delete, or retrieve files or execute code.Examples include altering configuration files and exfiltrating keys; rug-pull attacks change a tool’s __doc__ after users install an initially legitimate service.Source: 1) Single Tool Attack · p. 4
2) Multi-Tool Attack:
- Multi-tool attacks manipulate third-party tools or coordinate multiple tools to achieve complex objectives.Shadowing can influence a legitimate tool through another tool’s description, while coordinated tools can exploit contextual relationships and infectious attacks can propagate risky code to generated tools.Source: 2) Multi-Tool Attack · pp. 4–5
B. Indirect Tool Injection Attack
The taxonomy extends MCP attacks beyond direct tool injection to attacks carried by external data, malicious users, and LLM behaviors. It describes how tool access and shared context can expose agents to these attack paths.
B. Indirect Tool Injection Attack
- Indirect attacks use webpages, project README files, or tool-return strings to deliver commands or manipulate agent behavior.Hidden webpage instructions may trigger through automatic loading; malicious installation instructions can execute during setup, and tool outputs can prompt further calls or command chains.Source: B. Indirect Tool Injection Attack · p. 5
C. Malicious User Attack
- Malicious users can register harmful tools, exploit shared-server permissions, inject tainted data, steal tokens, leak server code, spoof installers, or escape sandboxes.The described risks include backdoors or API-key changes, unauthorized access to linked services, and exposure of source code or configurations.Source: C. Malicious User Attack · pp. 5–6
D. LLM Inherent Attack
- Jailbreak, prompt-leakage, and hallucination attacks exploit tool descriptions, web data, or tool chains to alter behavior or elicit sensitive or false outputs.The paper notes that a successful jailbreak may persist across subsequent tools because MCP lacks context isolation; misleading tool descriptions can also yield fabricated answers.Source: D. LLM Inherent Attack · p. 6
- Backdoor, goal-hijack, SQL-injection, and API-theft attacks use MCP tools, resources, or stored credentials to trigger code, redirect objectives, or expose data.The examples include preembedded resource scripts, tool-chain dependencies that amplify errors, and reading local configuration files to obtain API tokens.Source: D. LLM Inherent Attack · p. 6
IV. EXPERIMENT
The experiment introduces Attack Efficacy to quantify MCP attack harm across multiple dimensions. It combines normalized indicators using entropy-derived weights and presents the resulting scores in Table II.
IV. EXPERIMENT
- The experiment first evaluates attack efficacy quantitatively, then uses representative attacks to illustrate MCP-agent characteristics.The supplied passages describe the evaluation procedure but do not provide Table II's score values.Source: §IV · p. 6, A. Quantitative Evaluation of Attack… · p. 7
A. Quantitative Evaluation of Attack Efficacy
- Attack Efficacy combines success rate, security risk level, persistent impact scope, and implementation difficulty into a quantitative measure of attack harm.The paper describes success rate as based on 10 repeated experiments and uses a seven-level risk classification; impact scope and implementation difficulty are scored by stated categories.Source: A. Quantitative Evaluation of Attack… · pp. 6–7
- The evaluation normalizes indicators, derives their relative weights with an entropy-weight method, and applies a weighted sum to produce attack scores.The paper uses reverse normalization for implementation difficulty, calculates entropy-based weights, and reports the scores in Table II.Source: A. Quantitative Evaluation of Attack… · pp. 6–7, Table II · p. 7
B. Attack Sensitivity of MCP Agents
The experiments show that file operations can be induced without confirmation, while command execution typically requires user approval. The demonstrated attacks exploit this permission difference and conceal malicious actions in file workflows or remote projects.
B. Attack Sensitivity of MCP Agents
- A tool description induced the agent to back up and tamper with configuration-related files before answering a stock query.The attack disguised reading a configuration file as caching and appended malicious instructions under the guise of repair; the agent performed the operations without asking permission.Source: B. Attack Sensitivity of MCP Agents · p. 7, Figure 3 · p. 8
- A seemingly legitimate stock-query tool induced the agent to download a GitHub project and execute its README installation instructions.The malicious execution logic was hidden in the remote repository rather than the local tool description, and the agent successfully executed the code.Source: B. Attack Sensitivity of MCP Agents · p. 8, Figure 4 · p. 8
- File operations such as reading, copying, and modifying files ran before the query without confirmation, while RCE and project-install commands required user confirmation at each step.The authors report that attacks targeting critical files can be as threatening as RCE despite their greater concealment.Source: Figure 2 · p. 7, B. Attack Sensitivity of MCP Agents · p. 8, Figure 5 · p. 8
C. Tool Descriptions Dependency
MCP agents’ tool choices depend heavily on tool descriptions, which misleading descriptions can use to redirect behavior. In experiments, Malicious Tool Coverage had the strongest reported effect, while all three tested attacks succeeded at high rates.
C. Tool Descriptions Dependency
- MTC claims the original method is deprecated and directs the LLM to a specific tool, while SA and TPMA use different description-based tactics.SA influences benign-tool behavior; TPMA describes its tool as the “best” option.Source: C. Tool Descriptions Dependency · pp. 8–9
- MCP agents often choose, execute, or modify tools based on descriptions rather than their actual functionality.Descriptions of other tools can become criteria for evaluating a current tool and influence its execution.Source: C. Tool Descriptions Dependency · p. 9
D. Chain Attacks via Shared-context and Context Learning
Shared MCP context can carry malicious behavior from one tool into another. The experiments illustrate both generation of a malicious, functionally similar tool and unintended data extraction through cooperation between tools.
D. Chain Attacks via Shared-context and Context Learning
- A malicious “add” tool that reads sensitive files and stores them in a “sidenote” can influence generation of a malicious subtraction tool, even without an explicit request for malicious behavior.The agent relies on contextual information from the existing tool when generating the similar tool.Source: D. Chain Attacks via Shared-context… · p. 9
- A “Division” tool can infer “sidenote” from the shared context established by “add,” leading to unintended data extraction.The Division tool does not explicitly define “sidenote.”Source: D. Chain Attacks via Shared-context… · p. 9, Figure 7 · p. 9, Figure 8 · p. 9
- The authors describe context learning as enabling agents to reproduce vulnerabilities in newly generated tools and to repair tool flaws using shared context.The latter behavior can make the agent an accomplice in a multi-tool cooperation attack.Source: D. Chain Attacks via Shared-context… · p. 9
E. Ambiguous Boundaries between Data and Instructions
Indirect injection attacks exploit the agent’s difficulty distinguishing external data from executable instructions. Tool-return attacks had higher reported success than webpage and third-party dataset poisoning in the tested scenarios.
E. Ambiguous Boundaries between Data and Instructions
- Attacks using data returned by MCP tools achieved significantly higher success rates than webpage poisoning and third-party dataset poisoning.The authors attribute this pattern as likely related to abuse of the LLM’s trust in tool returns as system-verified feedback.Source: E. Ambiguous Boundaries between Data… · p. 10
- Webpage and third-party dataset poisoning involve longer trigger paths and possible uncertainty from user interactions, while ciphertext commands had lower success.The authors suggest ciphertext may trigger internal security inspection mechanisms.Source: E. Ambiguous Boundaries between Data… · p. 10
- The agent can misinterpret third-party data or tool outputs as instructions and execute malicious payloads, even when the data is illogical or nonsensical.The passage identifies this inability to distinguish external data from executable instructions as central to indirect tool injection attacks.Source: E. Ambiguous Boundaries between Data… · p. 10
V. RELATED WORK
Prior MCP security work includes varied attack proposals and defense tools, but the paper characterizes academic coverage as limited and fragmented. MCPXKIT organizes and empirically validates attack patterns, with future work directed toward additional attack modeling and defenses.
A. MCP Attack
- Earlier MCP attack research includes tool-poisoning and indirect-injection proposals, while some academic work is narrow or remains theoretical.The cited work also includes preference manipulation, lifecycle risk categorization, and attack models such as Name Collision and Sandbox Escape.Source: A. MCP Attack · p. 10
B. MCP Defense
- MCP defenses described in prior work include server-side scanning, interaction monitoring, middleware controls, and multi-agent security evaluation.The surveyed approaches include MCP-Scan, MCP Guardian, AI-Infra-Guard, and McpSafetyScanner.Source: B. MCP Defense · p. 10
VI. CONCLUSION AND FUTURE WORK
- MCPXKIT categorizes 31 attack types into four categories and provides a plugin-based toolkit with quantitative efficacy analysis.The paper also examines underlying causes and presents insights intended to inform MCP development and defense.Source: §VI · p. 10
- Future work will model malicious user attacks, design dynamic defense frameworks, and establish MCP security standards.The authors aim to promote research and offer reusable attack models and defensive strategies.Source: §VI · p. 11