PaperlayerView exact revision on arXiv

Source-linked AI summary

AEGIS: Preventing Cross-Domain Resource Abuse in MCP

Shriti Priya, Teryl Taylor, Frederico Araujo

arXiv:2608.20481v1cs.CRcs.AI

TL;DR

MCP tools expose heterogeneous, modality-specific parameters that can be abused to exhaust resources, while existing policy mechanisms are difficult to generalize across servers. AEGIS uses LLMs to classify and normalize tool invocations into reusable policy representations and combines them with threshold-based enforcement. The evaluation reports over 90% accuracy for several classification tasks and demonstrates end-to-end protection, while identifying parameter normalization and limited evaluation scope as remaining constraints.

  • Problem

    Heterogeneous MCP tools expose modality-specific resource-abuse parameters, making fine-grained policies difficult to author and enforce across servers.

  • Method

    AEGIS uses LLMs to identify and normalize resource-related tool parameters into a unified taxonomy supporting reusable policies and threshold enforcement.

  • Results

    Over 90% accuracy was achieved for classifying modality, operation, resource usage, and parameters, while AEGIS maintained availability and eliminated errors in a high-count abuse scenario.

  • Takeaways & Limitations

    AEGIS provides a proof of concept for end-to-end resource-abuse protection across MCP servers and modalities.

  • Takeaways & Limitations

    Parameter normalization remains challenging, and the evaluation is limited in scope and coverage.

Abstract

from arXiv · show

The Model Context Protocol (MCP) is an open source JSON-RPC protocol that standardizes how large language models (LLMs) interact with external systems through programmatic functions known as tools. Attackers or malicious agents can exploit certain modalities of these MCP tools to degrade the overall quality of service of agent-based applications. For example, an agent may request an excessively large search radius or very long videos, overloading backend systems and potentially causing slowdowns or denial-of-service. Each modality including text, images, video, and location introduces distinct vectors for resource abuse, complicating the development of consistent mitigation strategies. Moreover, multimodal and crossdomain tools expose diverse request schemas and parameters, making it difficult to define policies that are both generalizable and precise enough to enforce meaningful resource constraints. In this paper, we present AEGIS, a policy enforcement component that enables administrators to define fine-grained safeguards against resource abuse across heterogeneous MCP tools and modalities. AEGIS leverages the reasoning capabilities of large language models to analyze, categorize, and normalize diverse tool invocations into a unified, policy-friendly representation accessible to security practitioners. Integrated with the Open Policy Agent and the ContextForge AI Gateway, AEGIS detects and mitigates abusive behaviors while preserving the flexibility of MCP-based agent ecosystems.

I. INTRODUCTION

MCP resource abuse arises because heterogeneous, multimodal tools expose parameters and operations that can trigger excessive consumption, while their semantic diversity makes scalable policy authoring difficult. AEGIS addresses this with LLM-assisted parameter analysis, normalization, and threshold-based enforcement.

  • MCP servers expose resource-exhaustion risks because attackers can exploit tool parameters to trigger excessive consumption.A study of 1,000 servers found 15% vulnerable to resource exhaustion, including missing pagination limits, memory loops, leaks, and single-request outages.
  • Multimodal tasks combine distinct abuse vectors across text, images, video, audio, and location tools.A single restaurant-search example requires location queries, text retrieval, and image generation.
  • Temporal, volumetric, and qualitative parameters can each cause excessive consumption when left unbounded.Examples include historical queries, many high-resolution images, and indefinitely expanding spatial searches.
  • Generation, retrieval, and deletion operations have different resource profiles, complicating consistent controls.Generating 100 images is typically more resource-intensive than retrieving 100 existing images.
  • Inconsistent parameter names across servers force policy writers to manually normalize heterogeneous vocabularies.Equivalent concepts may appear as radius, initial_radius, end_position, limit, maxResults, or count.
  • AEGIS uses LLMs to identify resource-related parameters, normalize them into a unified taxonomy, and support reusable policy templates and threshold enforcement.Its stated contributions include systematic parameter investigation, scalable policy enforcement, and end-to-end protection against resource-abuse attacks.

II. BACKGROUND AND RELATED WORK

MCP gateways centralize access to diverse servers, but existing defenses do not provide fine-grained, parameter-specific controls across heterogeneous and multimodal ecosystems. AEGIS targets this gap with dynamic, parameter-aware runtime enforcement.

  • MCP is an open protocol that lets AI agents connect to external tools, data sources, and services through a client–server architecture.Gateways commonly provide centralized routing, authentication, access control, and observability across multiple servers.
  • Agent-generated tool calls can trigger expensive operations even when requests appear valid, creating resource-overload risks.Reported consequences include denial-of-service, higher operational costs, and cascading failures.
  • Existing defenses include rate limiting, quotas, provenance tracking, signed definitions, penetration testing, and loop-aware monitoring.These approaches broaden coverage of MCP attack surfaces but do not standardize cost semantics or trajectory-level verification.
  • AEGIS adds dynamic, parameter-aware runtime controls across heterogeneous and multimodal MCP servers.Its policies incorporate argument semantics and enforce CPU and memory limits per invocation, unlike mainly static constraints.

III. THREAT MODEL

The paper models resource overload from excessive or unbounded parameters in multimodal MCP tools, excluding network flooding and protocol vulnerabilities. AEGIS formalizes tool definitions through an ontology that supports reusable policies and thresholds.

  • The threat model assumes distributed agent workflows using multiple MCP servers whose tools lack robust parameter validation.Misuse may come from a compromised agent or an unintentional excessive request.
  • The scope targets individual requests with excessive or unbounded parameters that consume disproportionate computational, memory, or service capacity.Network-level denial-of-service, MCP-protocol vulnerabilities, and high-volume flooding are excluded.
  • AEGIS uses a Tool Ontology to categorize tools and parameters, enabling reusable policies and resource-abuse thresholds.The ontology formalizes and simplifies tool definitions before policy modeling.
  • Tools are classified by modality and operation, with transform, retrieve, and delete operations reflecting different resource profiles.Measurement units can therefore differ, such as counts for text retrieval and seconds for video duration.
  • Parameters are categorized as volumetric, timebound, or qualitative according to whether they control volume, temporal extent, or output quality.In generateImages, n is volumetric and resolution is qualitative.
  • Parameter normalization maps heterogeneous names to common concepts, such as converting n to num_records.The vocabulary was derived by analyzing 56 widely used MCP servers.

B. Policy Templates

AEGIS policies use ontology-derived parameter references to abstract away individual tool implementations. This abstraction reduces policy complexity and supports reuse across heterogeneous MCP servers.

  • Policy templates reference normalized parameters using dot notation derived from the ontology layers.The templates are designed to decouple policies from individual tool implementations.
  • This abstraction reduces policy complexity and enables policy reuse across heterogeneous MCP servers.

C. Policy Thresholds

AEGIS selects policy thresholds to prevent resource abuse while preserving stable server operation across modalities. It derives each threshold from the highest parameter value that remains within an acceptable error tolerance.

  • Threshold selection must account for different baseline CPU and memory usage across text, image, and audio servers.
  • AEGIS increases parameter values until system performance exceeds the specified error tolerance, then selects the highest stable value as the threshold.
  • AEGIS generates tool ontologies, constructs policy templates, estimates thresholds, and enforces the resulting policies through an MCP gateway.

A. Bootstrapping Phase

AEGIS bootstraps policy enforcement offline by collecting tool definitions, using an LLM to create and validate ontologies, caching them, benchmarking servers, and updating policy thresholds for deployment.

  • Bootstrapping is an offline process that prepares policies before deployment.
  • AEGIS retrieves registered tool definitions through the gateway’s list_tools() API before ontology identification.
  • An LLM processes each tool definition through six steps covering modality, operation, abuse potential, resource parameters, parameter characteristics, and normalization.
  • The prompt provides a predefined normalization taxonomy, server-specific context, and strict JSON output to support consistent ontology generation.
  • AEGIS validates ontology structure, taxonomy keys, and parameter presence, re-prompting invalid outputs or flagging them for human review.
  • Validated ontologies are cached for runtime normalization, while benchmarking varies parameters and concurrent users to measure system behavior.
  • AEGIS selects thresholds that keep error rates within tolerance across load levels and inserts them into server-specific policy templates.

B. Runtime Phase

During runtime, AEGIS normalizes cached tool parameters and evaluates them against policies before forwarding requests to MCP servers. Requests exceeding thresholds are rejected, while uncached ontologies fall outside enforcement.

  • At runtime, AEGIS uses a framework such as Open Policy Agent to enforce policies.
  • For cached ontologies, AEGIS normalizes request parameters and evaluates them against policy thresholds before forwarding or rejecting the request.
  • Requests whose ontologies are not cached bypass normalization and are considered out of scope for policy enforcement.

VI. IMPLEMENTATION

AEGIS is implemented as a ContextForge AI Gateway component that processes tool invocations before OPA enforcement. Its evaluation examines ontology identification accuracy and protection against resource abuse attacks.

  • The runtime component uses the ContextForge AI Gateway’s plugin framework for modular extension and policy control.
  • AEGIS adopts the preexisting OPA plugin as its foundational enforcement layer and processes each invocation before forwarding it to OPA.
  • During bootstrapping, AEGIS uses Claude 4 Sonnet to identify tool ontologies and caches them in Redis.
  • The evaluation asks how accurately AEGIS identifies and categorizes tool ontologies from MCP definitions.
  • The evaluation also asks how effectively AEGIS protects MCP servers against resource abuse attacks.

A. Dataset

AEGIS’s dataset comprises 937 manually reviewed tool definitions from 56 MCP servers, spanning diverse modalities and operation types. The annotations identify resource-sensitive tools and normalize parameters for policy analysis.

  • Dataset construction: The dataset contains 937 tool definitions collected from 56 MCP servers in the OpenTools MCP Registry.The servers span cloud infrastructure, databases, productivity, search, APIs, analytics, gaming, and development tools.
  • Annotation schema: Each tool received a primary modality label covering text, image, human, video, audio, or location.Tools were labeled according to the primary data modality they process.
  • Annotation schema: Tools were classified by operation type as retrieve, transform, or delete, and marked resource-sensitive when any parameter could cause excessive resource usage.A tool was resource-sensitive if at least one parameter could potentially lead to unrestricted consumption.
  • Annotation schema: Parameters were categorized as volumetric, qualitative, or timebound, then normalized using a predefined parameter taxonomy.Normalization addresses heterogeneous parameter names across MCP tools.
  • Dataset insights: 869 tools were text-based, 38 image-based, 14 location-based, 10 video-based, 5 audio-based, and 1 human-focused; 441 tools contained potentially abusive parameters.Operation counts were 572 retrieve, 308 transform, and 57 delete tools.

B. Accuracy (RQ1)

AEGIS was evaluated both on LLM-based ontology identification and on policy enforcement under controlled resource-abuse loads. The evaluation used repeated classification experiments and 118 CIFAR-10 benchmark runs to derive and test thresholds.

  • Ontology accuracy: Ontology identification was evaluated against manually labeled ground truth using accuracy, precision, recall, and F1-score.The comparison covered modality, operation, parameter characteristics, resource consumption, and parameter normalization tasks.
  • Ontology accuracy: More than 84% accuracy was achieved across all ontology identification tasks, with parameter normalization performing comparatively worse because of contextual ambiguity.Experiments used Claude 4 Sonnet across three runs, with each inference taking approximately 0.52 seconds.
  • Threshold evaluation: The resource-abuse evaluation derived parameter thresholds by testing whether policy enforcement prevented overload while maintaining normal operation.The experiments measured policy enforcement under varying load conditions.
  • Threshold evaluation: Threshold estimation used a CIFAR-10 FastMCP server exposing image tools, with concurrent-user loads from 10 to 1000 and count values from 1 to 100.The experiment comprised 118 benchmark runs, each lasting approximately 8 minutes.
  • Threshold evaluation: Error rate was the primary threshold-selection criterion among latency, throughput, errors, resource usage, and wall-clock metrics.The criterion was selected because it generalizes across heterogeneous MCP servers.
  • Threshold results: count=10 kept error rates below 0.1% across all tested load levels, whereas count=100 produced significant error spikes, so AEGIS selected count=10.The threshold was derived from the 118 benchmark runs.
  • Threshold results: Under count=1000 with 200 concurrent users, AEGIS maintained server availability, eliminated errors, and improved overall request throughput compared with the unprotected configuration.The comparison evaluated resource-abuse performance with and without policy enforcement.

VIII. CONCLUSION

AEGIS uses LLMs to classify and normalize resource-related tool information across MCP servers and modalities. The study reports strong classification accuracy, while identifying parameter normalization and broader real-world coverage as continuing challenges.

  • Conclusion: AEGIS achieved over 90% accuracy in classifying modality, operation, resource usage, and parameters.The reported classification result covers resource-abuse analysis across MCP servers and modalities.
  • Conclusion: Parameter normalization remains challenging, and the evaluation is limited in scope and coverage as a proof of concept.Future work will extend evaluation to real-world MCP services and cascading tool invocations.
Loading 2608.20481v1…