PaperlayerView exact revision on arXiv

Source-linked AI summary

Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP

Zeynab Anbiaee, Mahdi Rabbani, Mansur Mirani, Gunjan Piya, Igor Opushnyev, Ali Ghorbani, Sajjad Dadkhah

arXiv:2602.11327v2cs.CRcs.AI

TL;DR

Agent communication protocols are advancing faster than their security principles and standardized threat modeling, leaving protocol-level risks insufficiently assessed. This paper comparatively analyzes MCP, A2A, Agora, and ANP through structured threat modeling, lifecycle-aware qualitative assessment, and an MCP measurement case study. It identifies shared structural weaknesses and demonstrates wrong-provider tool execution when provider identity is not cryptographically bound to tool identity.

  • Problem

    Security research on emerging agent communication protocols remains limited, fragmented, and without a unified protocol-centric risk assessment framework.

  • Method

    The paper combines comparative threat modeling, a twelve-risk lifecycle framework spanning creation, operation, and update, and an MCP case study measuring misbinding under resolver policies.

  • Results

    The analysis finds shared weaknesses in authentication, supply-chain integrity, operational reliability, governance, identity assumptions, and cross-protocol collaboration, while MCP experiments quantify wrong-provider execution.

  • Takeaways & Limitations

    Secure deployment and future standardization should address lifecycle risks, governance, identity consistency, and cross-protocol composition in agent communication ecosystems.

  • Takeaways & Limitations

    MCP still lacks a comprehensive security layer, posing particular challenges for financial or safety-critical tool invocations.

Abstract

from arXiv · show

The rapid development of the AI agent communication protocols, including the Model Context Protocol (MCP), Agent2Agent (A2A), Agora, and Agent Network Protocol (ANP), is reshaping how AI agents communicate with tools, services, and each other. While these protocols support scalable multi-agent interaction and cross-organizational interoperability, their security principles remain understudied, and standardized threat modeling is limited; no protocol-centric risk assessment framework has been established yet. This paper presents a systematic security analysis of four emerging AI agent communication protocols. First, we develop a structured threat modeling analysis that examines protocol architectures, trust assumptions, interaction patterns, and lifecycle behaviors to identify protocol-specific and cross-protocol risk surfaces. Second, we introduce a qualitative risk assessment framework that identifies twelve protocol-level risks and evaluates security posture across the creation, operation, and update phases through systematic assessment of likelihood, impact, and overall protocol risk, with implications for secure deployment and future standardization. Third, we provide a measurement-driven case study on MCP that formalizes the risk of missing mandatory validation/attestation for executable components as a falsifiable security claim by quantifying wrong-provider tool execution under multi-server composition across representative resolver policies. Collectively, our results highlight key design-induced risk surfaces and provide actionable guidance for secure deployment and future standardization of agent communication ecosystems.

1. Introduction

As AI evolved toward proactive, autonomous agents, secure communication across tools, environments, and agents became foundational, while protocol-level security mechanisms lagged behind. This paper addresses that gap with comparative threat modeling, lifecycle-aware risk assessment, and an MCP measurement case study.

  • AI agents extend LLMs from passive responders into autonomous entities that interact with tools, environments, and other agents.
  • Cybersecurity mechanisms have not kept pace with agentic AI, making protocol interactions, trust boundaries, and failure propagation important security concerns.
  • The paper develops a protocol-centric analysis integrating threat modeling, architectural analysis, and lifecycle-aware risk assessment across emerging agent ecosystems.
  • The study comparatively threat-models MCP, A2A, ANP, and Agora under realistic deployment assumptions and consolidates their risk surfaces into a coherent taxonomy.
  • The assessment identifies twelve protocol-level risks and evaluates security posture across creation, operation, and update phases.
  • The MCP case study quantifies wrong-provider tool execution under multi-server composition and multiple resolver policies as a falsifiable security claim.

2. Related Work

Prior research on agent and protocol security is fragmented, often conceptual, and rarely provides formal threat models or protocol-level enforcement. This study responds by comparatively examining four relatively mature protocols and their ecosystem-wide risks.

  • Many agent communication protocols proposed in early 2025 remain conceptual and lack real-world implementation or evaluation.
  • Existing MCP research examines architecture, lifecycle problems, or defense in depth, but no prior work delivers a fully formal MCP threat model.
  • A2A studies address edge constraints, Agent Card management, task integrity, authentication, and sensitive-data handling across specialized settings.
  • Broader multi-agent studies show that vulnerabilities in individual components can cascade through inter-agent communications, while some network approaches treat security as an underlying network property.
  • Agora research emphasizes communication efficiency and scalability, whereas ANP work emphasizes decentralized identity and interoperability without rigorous security assessment or experimental evaluation.
  • Existing surveys generally focus on isolated components or interaction patterns and discuss security without formal threat models or protocol-level enforcement mechanisms.

3. Foundations of Agent Communication Protocols

Agent communication protocols connect AI systems to tools, data, and other agents through distinct architectures and interaction models. MCP centers tool integration, A2A supports distributed task execution, Agora enables negotiated protocols, and ANP provides layered interoperability.

  • AI agent protocols address the isolation of assistants from external data, tools, and systems by providing interfaces for connecting AI systems with resources and agents.
  • MCP: MCP uses a host, client, and server architecture, with server creation, operation, and update phases governing registration, tool invocation, sandboxing, and post-update permissions.
  • A2A: A2A uses HTTP(S), SSE, JSON-RPC, OAuth 2.0, and JWTs to support authenticated communication and resource access between agents.
  • A2A: A2A distributes task execution between client and remote agents, using agent cards, protocol-object lifecycles, contextual messages, intermediate responses, and artifacts.
  • Agora: Agora uses decentralized Protocol Documents to let agents negotiate, adapt, and modify communication protocols without central authorities.
  • ANP: ANP combines decentralized identity and encrypted communication, meta-protocol negotiation, and application-layer discovery and descriptions for authenticated collaboration.

4. Threat Model

The threat model organizes protocol risks around authentication and access control, supply-chain and ecosystem integrity, and operational integrity and reliability. It examines weaknesses across agent identity, permissions, discovery, tokens, and deployment practices.

  • The threat taxonomy groups attacks into authentication and access control, supply-chain and ecosystem integrity, and operational integrity and reliability.
  • Authentication & Access Control: Authentication and access-control attacks undermine agent identity, credential verification, and enforcement of permissions.
  • Authentication & Access Control: Early MCP lacked authentication and was vulnerable to impersonation and spoofing until MCP v1.2 added token-based authentication.
  • Authentication & Access Control: MCP’s coarse permissions lack field-, endpoint-, and task-level restrictions, exposing systems to unauthorized access and privilege escalation.
  • Authentication & Access Control: Name- and description-based discovery without cryptographic evidence enables close-name impersonation in MCP and capability or identity spoofing in open ANP discovery.
  • Authentication & Access Control: A2A token risks include unrestricted token lifetimes and coarse scopes, allowing intercepted tokens to be reused and potentially expanded beyond intended privileges.

4.2. Supply Chain and Ecosystem Integrity

Supply-chain and ecosystem threats target installers, dependencies, tool selection, and trusted relationships across MCP and A2A. These risks can introduce malware, hijack workflows, or activate malicious behavior after trust is established.

  • Installer Spoofing: Altered installers can install malware or backdoors during creation, while MCP’s community-driven ecosystem leaves this attack surface massive and largely uncontrolled.Attackers may gain long-term access, exfiltrate credentials, or reconfigure servers through malicious installers.
  • Dependency and Component Integrity: Compromised community-maintained dependencies can introduce backdoors, steal data, and increase privileges after installation.This vector affects the payload and persistence stage rather than initial installer delivery.
  • Tool Selection Integrity: Misleadingly named or described tools can be prioritized by MCP clients, causing toolflow hijacking that may steal sensitive data or execute malicious code.The risk arises because MCP agents independently choose tools using names and descriptions.
  • Rug-Pull Attacks: Rug-pull attacks exploit established trust by changing an initially appropriate tool’s or agent’s behavior after integration into critical workflows.MCP and A2A’s dynamic discovery and relationship model makes later behavioral changes a serious integrity threat.

4.3. Operational Integrity and Reliability

Operational threats disrupt task execution, isolation, workflow outputs, and update security in dynamic agent networks. The section also identifies configuration drift as a multi-tenant exposure and notes that Agora and ANP remain less studied.

  • Command Ambiguity: Similar slash commands can let attackers insert incompatible commands that cause MCP clients to take unwanted actions.The flexible multi-tool environment provides extensibility but lacks powerful disambiguation.
  • Sandbox Escape: Unpatched sandbox vulnerabilities may let malicious MCP tools breach isolation, execute arbitrary host code, access sensitive data, or escalate privileges.This is especially consequential in enterprise deployments where MCP hosts typically access many tools and resources.
  • Runtime Workflow Shadowing: Runtime shadowing can intercept workflows and replace or modify outputs, silently corrupting multi-agent workflows in MCP and A2A.The attack exploits decentralized discovery after a legitimate tool has been selected.
  • Post-Update Privilege Persistence: Residual privileges after MCP server updates can enable adversaries to steal resources or cause malfunction because revocation fails to propagate.This vulnerability concerns update-time revocation rather than baseline access-control design.
  • Version and Configuration Drift: Community-based decentralization creates a window for redeploying vulnerable MCP versions because no official package-management or auditing authority enforces secure versions.Attackers may exploit known vulnerabilities before patches are adopted.
  • Version and Configuration Drift: Configuration drift in MCP can expose sensitive resources, escalate privileges, or extend attacker access across tenants in multi-tenant environments.The issue is a gradual buildup of unwanted configuration changes against a secure baseline.
  • Evidence Scope: Published security analyses for Agora and ANP remain limited because all four protocols are young, evolving, and only recently subject to systematic evaluation.Existing literature focuses primarily on MCP and A2A.

5. Evaluation

The evaluation treats risk management as a lifecycle-wide process for identifying, assessing, and mitigating vulnerabilities in AI-agent communication protocols.

  • Evaluation: Risk assessment examines the protocol lifecycle to identify vulnerabilities that are most likely and impactful, with the goal of reducing security risks to manageable levels.The process covers identifying, assessing, and mitigating risks across lifecycle stages.

5.1. Assessment Methodology

The assessment methodology adapts NIST SP 800-30 into a qualitative, lifecycle-aware framework for protocol-level vulnerabilities. It evaluates threat sources, vulnerabilities, likelihood, impact, and overall risk using architectural evidence and an ordinal risk matrix.

  • Assessment Workflow: NIST SP 800-30 structures the assessment around threat sources, vulnerabilities, likelihood, impact, and final risk values.Figure 4 presents the workflow adopted in this work.
  • Qualitative Scoring: The study rates likelihood, impact, and risk qualitatively on Low, Medium, and High levels to support consistent reasoning across different protocol architectures.Low denotes rare or minor conditions, Medium partial or moderate conditions, and High frequent or severe effects.
  • Evidence Basis: Because public deployments and incident data are limited, ratings derive from protocol specifications, documented design decisions, and observable security-control placement.Intrinsic exploitability considers whether controls are mandatory, optional, or absent, along with scope and propagation capability.
  • Threat Sources: Threats are analyzed at the protocol level rather than through specific adversary personas, regardless of attacker sophistication.Threat origins include malicious humans, compromised legitimate agents, and accidental or non-malicious sources.
  • Vulnerability Identification: The framework defines vulnerabilities as non-existent, weak, or unenforced protocol or deployment controls that facilitate threat events when exploited.Selected vulnerabilities must arise directly from protocol specifications or documented design decisions and affect lifecycle risk exposure.
  • Lifecycle Coverage: The vulnerability inventory spans creation, operation, and update stages, including identity, integrity, namespace, data-flow, privilege, resource-exhaustion, revocation, rollback, update-authentication, and dependency controls.Examples include shared credentials, unsigned registration files, persistent tokens, missing rate limits, residual privileges, downgrade paths, and configuration drift.
  • Likelihood: Likelihood combines intrinsic exploitability with environmental exposure, including protocol design flaws, API openness, and monitoring procedures.Ratings represent inherent protocol-level exploitability under standard deployment conditions.
  • Impact: Impact uses a three-level scale based on confidentiality, integrity, availability degradation, and operational consequences.The criteria adapt NIST guidance to the operational nature of AI-agent communication protocols.

5.2. Lifecycle-Based Evaluation Framework

The framework compares security across creation, operation, and update phases using a generalized lifecycle model and qualitative likelihood-impact risk assessment. Creation is the most security-important phase, while all phases expose substantial protocol risks.

  • Lifecycle model: The generalized lifecycle maps creation/configuration to identity and discovery, operation to runtime exchange and tool invocation, and update/maintenance to patching, negotiation, and version control.The model enables comparisons even though only MCP formally specifies these phases.
  • Stage 1: Creation/configuration: Creation/configuration is the most security-important phase because it establishes the trust, identity, and integrity assumptions underlying later interactions.The assessment finds vulnerabilities in this phase highly exploitable with predominantly high consequences.
  • Stage 1: Creation/configuration: Weak enrollment paths increase disclosure and impersonation risk, while A2A authentication reduces abuse risk but lacks a global integrity registry enforcing uniqueness.The comparative assessment places A2A between the higher-risk MCP and Agora patterns and stronger identity assumptions in ANP.
  • Stage 2: Operation: MCP and Agora have high operation-stage risk, A2A has moderate risk, and ANP combines strong authentication with higher impact from multilayer dependencies.MCP lacks runtime code-integrity enforcement; Agora relies on dynamic negotiation; A2A lacks semantic validation and strict token-lifetime guarantees.
  • Stage 3: Update & maintenance: All four protocols face medium to high update-maintenance risk because deployment reintroduces trust dependencies.MCP lacks forced revocation, version pinning, and post-deployment signing; coordinated revocation and version management remain systemic concerns.
  • Overall assessment: None of the examined protocols provides complete protection across the full lifecycle, leaving unresolved security and integrity risks for sensitive or cross-domain deployments.The conclusion calls for addressing fundamental vulnerabilities before such deployments.

6. Experimental Case Study

The MCP case study tests whether missing provider binding can cause wrong-provider tool execution under realistic multi-server conditions. Controlled experiments show that ambiguous tool identity produces reproducible misbinding across resolver policies.

  • Scope and threat model: The study targets MCP because it standardizes agent-to-tool/server invocation, making wrong-provider execution directly testable in a way not directly applicable to the other protocols.The evaluation uses a strict threat model that excludes host compromise, cryptographic breaks, and network MITM attacks.
  • Experimental design: The testbed combines an orchestrator with legitimate and attacker MCP servers advertising colliding tools, while varying attacker presence and selection policy.The setup uses static or registry-like discovery and records discovery artifacts, selection evidence, and the invoked server for replayable trials.
  • Metric: Violation Rate counts trials in which authorize_payment executes on the attacker provider while the legitimate server remains available.The metric specializes attack-success measurement to the wrong-server execution event.
  • Ambiguity mechanism: When multiple servers advertise the same non-unique tool name, realistic ordering, heuristic, or randomized policies can select an unwanted provider.The experiments test explicit multi-server discovery, registry-style ordering, and agent-like best-match selection with indistinguishable metadata.
  • Results: VR=1.0 occurs when an attacker is visible first or injects trust cues, while randomized tie-breaking yields VR=0.52 in 100 trials with cloned metadata.These results show that misbinding persists after ordering bias is removed.
  • Interpretation: The failure reflects missing cryptographic provider binding rather than a particular scoring function, allowing attacker-controlled execution in a financial workflow.The paper proposes provider-dependent tool identity validated by cryptographic certificates or signatures as future work.

7. Conclusion

The paper reviews security across MCP, A2A, Agora, and ANP while combining comparative threat modeling, lifecycle risk assessment, and an MCP measurement study. It identifies structural weaknesses and demonstrates that ambiguous tool identity can produce reproducible wrong-provider execution.

  • Contribution: The paper provides a systematic security review of four emerging agent communication protocols amid faster industry adoption than ecosystem security maturity.It consolidates scattered findings and identifies previously unreported attack vectors for Agora and ANP through architectural reasoning.
  • Lifecycle assessment: The lifecycle risk model identifies systemic weaknesses involving undeveloped governance, inconsistent identity assumptions, and cross-protocol collaboration.The model assesses threats across protocol lifecycle stages to support secure deployment.
  • MCP case study: The MCP case study shows that absent cryptographic provider binding, cross-server tool collisions yield wrong-provider execution under realistic resolver policies.Violation-rate measurement converts a design-level ambiguity into a concrete, reproducible security failure.

8. Future Research Directions

The paper identifies future security work for MCP and cross-protocol interoperability, including a formal MCP security extension and canonical safeguards against relay and downgrade paths.

  • MCP Security Extension: MCP needs a comprehensive security layer, especially for financial or safety-critical tool invocations that may trigger sensitive or irreversible activity.The proposed future direction is a formally defined MCP security extension.
  • MCP Security Extension: A proposed MCP extension would anchor cryptographic identity, use ephemeral access credentials, and verify permission scope.These additions are intended to support enterprise-grade and regulated settings.
  • MCP Security Extension: The proposed MCP security additions require measurement of latency, throughput, and failure behavior under partial adoption because they introduce overhead.Feasibility validation should cover operational effects rather than security properties alone.
  • Cross-Protocol Interoperability: Combining MCP, A2A, ANP, and Agora can create confusion, downgrade, and relay-abuse risks because their trust, authentication, and validation strategies differ.The paper therefore calls for cross-protocol security standards and interoperability hardening.
  • Cross-Protocol Interoperability: Interoperability layers should define a minimal canonical mapping for identity, capability, and provenance with explicit protocol-context binding.The stated purpose is to mitigate relay and downgrade paths.
Loading 2602.11327v2…