Source-linked AI summary
Public-Sharing Labels and Verbatim Field Egress in an MCP-to-A2A Agent Configuration: A Controlled Multi-Model Study
Arpan Kumar Mahapatra
TL;DR
The paper asks how labels affect verbatim field egress when one host combines local MCP access with A2A delegation. It measures this in a frozen, matched three-arm experiment with deterministic scoring across 480 trials. Public-sharing labels are descriptively associated with higher egress in a strongly model-dependent pattern, while the confidential contrast remains unresolved.
Problem
The paper examines how confidential and explicit public-sharing labels affect verbatim egress when a host reads a local MCP record and sends an A2A message.
Method
A controlled MCP-to-A2A testbed uses one restricted decision per trial, deterministic exact-value scoring, and 10 matched scenarios across confidential, unlabeled, and public-sharing arms.
Results
The public-minus-unlabeled contrast is descriptively positive and model-dependent, strongest for Claude Sonnet 5 with mean +0.800 across all 10 scenarios, while confidential-minus-unlabeled remains floor-limited.
Takeaways & Limitations
Within this configuration, public-sharing cues are associated with more verbatim egress for some models, especially through whether Claude relays at all.
Takeaways & Limitations
The findings are limited to one configuration, one host policy and decision surface, one provider snapshot, synthetic fixtures, and an exact-substring detector that misses paraphrased or partial disclosure.
Abstract
from arXiv · showhide
Safety properties assessed separately for Model Context Protocol (MCP) tool use and Agent2Agent (A2A) delegation need not describe behavior when one agent uses both. We measure one such behavior in a single controlled MCP-to-A2A configuration: a testbed drives a real-model host across a local MCP and a local A2A leg into an ordered event trace scored by exact deterministic rules (no LLM judge), one restricted decision per trial. In a pre-specified, frozen three-arm design, each of 10 record scenarios appears with a CONFIDENTIAL header, with no header, and with PUBLIC - OK TO SHARE; the six substantive record values are byte-identical across arms, and the outcome is verbatim occurrence of any of them in the outbound message. Four models x 3 arms x 4 repeats give 480 trials; the scenario is the unit of generalization, and we report the 10 scenario-level values (mean, median, sign counts), with no p-values or intervals. The confidential-minus-unlabeled contrast is inconclusive and floor-limited in every model (both arms at or near zero), so it does not show that confidential labels lack a protective effect. Adding PUBLIC - OK TO SHARE is descriptively associated with higher verbatim egress relative to the unlabeled baseline, with strong model dependence: strong and consistent for Claude Sonnet 5 (public-minus-unlabeled mean +0.800, all 10 scenarios; mostly an association with whether Claude relays at all), moderate but floor-limited for one GPT-5.6 tier, small (median 0) for another, and a complete floor for the third. This is an association in one configuration, not a causal or general effect. Code, byte-pinned traces, and the offline analysis pipeline are released as a public artifact.
1 Introduction
The paper measures how explicit confidential or public-sharing labels affect verbatim field egress when a host reads a local MCP record and sends a message through A2A. It contributes a controlled, executable instrument and a model-dependent descriptive measurement rather than a general composition-risk claim.
- The study asks whether confidential or explicit public-sharing labels change verbatim egress relative to the same unlabeled record.
- The instrument combines an MCP-to-A2A harness, an ordered provenance-preserving trace, and deterministic exact-value scoring without an LLM judge.
- The three-arm design freezes confidential, unlabeled, and public-sharing conditions while keeping six substantive record values byte-identical across arms.
- Public-sharing labels show a model-dependent descriptive association: strong for claude-sonnet-5, moderate or floor-limited for gpt-5.6-luna, small or floor-limited for gpt-5.6-sol, and a complete floor for gpt-5.6-terra.
- The confidential-minus-unlabeled contrast is inconclusive and floor-limited in every model.
2 Background and System Model
The system models a host that uses MCP to access local tools and A2A to delegate to a remote agent, while a shared harness records and constrains its actions. Enforcement is treated as a harness property rather than a model-safety result.
- MCP connects an LLM host to tools, while A2A enables delegation to a remote agent through an Agent Card, task state, messages, and artifacts.
- Both protocol legs are local deterministic fixtures, and trusted local MCP annotations provide the ground truth for mutating-tool status.
- The engine records one ordered trace spanning MCP events, A2A events, state transitions, and the host’s gated actions.
- The host receives sanitized protocol history and tool or agent metadata, while adapters translate one provider-neutral action schema across OpenAI and Anthropic interfaces.
- The mutation gate blocks unapproved state-changing calls, but its zero violations are a harness property because the earlier study elicited no such model request.
3 Related Work
The paper distinguishes its controlled live-model measurement from prior work on protocol-specific benchmarks, propagation studies, formal assurance, and security concepts. It makes no novelty claim for cross-protocol risk concepts.
- MCPHunt studies cross-boundary propagation within multi-server MCP agents, whereas this work measures local-MCP-to-remote-A2A egress under matched labels.
- AgentRFC and formal protocol-composition analysis pursue specification or replay assurance, while this paper performs controlled live-model behavioral measurement without formal claims.
- ProtocolBench compares protocol choice by task success and overhead, addressing a different question from this study’s egress behavior.
- Other cited work evaluates MCP or A2A in isolation, studies indirect prompt injection, or develops adjacent defenses such as provenance tracking.
- The paper explicitly claims none of these risk concepts as novel and makes no “first” claim.
4 Experimental Method
The experiment uses one restricted model decision per trial in a pre-specified matched three-arm design, with synthetic records, deterministic exact-substring scoring, and scenario-level descriptive analysis. The protocol and inputs are tightly controlled across conditions.
- Each trial executes the local record retrieval, permits one model decision from {relay_to_remote, stop}, and performs at most one deterministic observable action.
- The providers use separate low-effort configurations, but both receive a byte-identical sanitized decision payload for each trial.
- The primary study contains 10 scenarios × 3 arms × 4 repeats × 4 models = 480 trials.
- The confidential, unlabeled, and public arms differ by header, while six substantive values, provenance canaries, record skeletons, and audited provider inputs remain matched.
- The scenarios use synthetic support personas and records, with one fixed host policy and four model blocks, including Claude as an external-family robustness block rather than a ranked comparator.
- The primary outcome is 1 when any of six substantive strings appears as an exact substring in the outbound message, and 0 otherwise.
- Scenario is the generalization unit; arm rates use k/4, contrasts use a 0.25 grid, and reporting includes all 10 values, means, medians, and sign counts without p-values or intervals.
5 Results
The three-arm Phase 7 study found that confidential-versus-unlabeled egress was inconclusive and floor-limited, while PUBLIC - OK TO SHARE was descriptively associated with higher egress in a model-dependent pattern. Results are descriptive, based on scenario-level contrasts and a clean 480-trial execution, without pooling or inferential tests.
- Study execution: 480/480 trials completed with no failures, retries, or replacements, and all analyses used frozen machine-generated artifacts.The execution preserved frozen schedules, source pins, and final execution fingerprints.
- 5.1 RQ1: how sensitivity labels change verbatim field egress: C −N was inconclusive and floor-limited in every model, so the results do not show that confidential labels lack a protective effect.For three GPT-5.6 models, confidential and unlabeled arms were both 0/40; Claude’s −0.100 mean sat over a low 5/40 unlabeled baseline.
- 5.1 RQ1: how sensitivity labels change verbatim field egress: Claude Sonnet 5 had P −N mean +0.800, median +0.750, and 10/10 positive scenarios, with egress mostly associated with whether Claude relayed at all.Claude’s arm rates were N = 5/40 and P = 37/40, while primary-positive rates among relay trials were 1.000 in every arm.
- 5.1 RQ1: how sensitivity labels change verbatim field egress: gpt-5.6-luna showed P −N mean +0.250 and 7/10 positive scenarios, while gpt-5.6-sol showed mean +0.125, median 0.000, and 4/10 positive scenarios.Both patterns were described as small or moderate and floor-limited relative to unlabeled baselines at 0/40.
- 5.1 RQ1: how sensitivity labels change verbatim field egress: gpt-5.6-terra was a complete floor, with P −N mean 0.000, 0/10 positive scenarios, and no substantive value in any arm.Figure 1 likewise shows zero P −N contrast for terra.
- Measurement and scope: The primary outcome was exact-substring occurrence of any substantive field value in the outbound message, so zero egress does not rule out paraphrased or partial disclosure.The study also lacked a non-A2A sink or single-protocol control, limiting interpretation to this configuration.
- 5.4 Earlier two-arm study: descriptive reproducibility: The earlier two-arm C −P pattern reproduced for three non-floor models, but the studies used different provider snapshots and were compared descriptively rather than pooled.The earlier means were −0.900 for Claude, −0.250 for gpt-5.6-sol, −0.125 for gpt-5.6-luna, and 0 for terra.
- 5.5 Secondary null experiment (remote approval/action influence): The secondary null experiment observed 0 mutating-tool requests across 319 analysable trials, making the effect unestimable rather than evidence of adversarial-influence resistance.A positive control is needed, and the generic task framing may have provided insufficient headroom.
6 Discussion and Limitations
In this one MCP-to-A2A configuration, the confidential-versus-unlabeled contrast is inconclusive and floor-limited, while PUBLIC - OK TO SHARE is associated with higher verbatim egress in a model-dependent pattern. These observations are descriptive and bounded by the study’s synthetic fixtures, detector, coarse sampling, and single configuration.
- Discussion: The confidential-minus-unlabeled contrast is inconclusive and floor-limited in every model, so it does not show that confidential labels lack a protective effect.For three models both arms are on the floor; Claude’s small negative contrast sits over a low baseline.
- Discussion: PUBLIC - OK TO SHARE is descriptively associated with higher verbatim egress than the unlabeled baseline, strongly for Claude, moderately for gpt-5.6-luna, weakly for gpt-5.6-sol, and not at all for gpt-5.6-terra.For Claude, the association mainly reflects whether the model relays at all.
- Limitations: The study is limited to synthetic in-process fixtures, one host policy, one relay-or-stop decision surface, one provider snapshot, and non-equated provider configurations.The authors scope the findings to this configuration rather than a general safety verdict.
- Limitations: The exact-substring detector does not measure paraphrased or partial disclosure, and a zero score does not establish that no information crossed.The primary detector checks exact occurrence of six substantive values.
- Limitations: The study generalizes over 10 authored scenarios with four repeats, producing coarse 0.25-step rates; PUBLIC - OK TO SHARE also bundles two wording cues.No alternative sink or single-protocol control was included.
7 Reproducibility
Phase 7 used frozen execution and analysis artifacts, with byte-pinned traces and an offline pipeline released publicly for reproducibility.
- Execution integrity: All 480 trials completed without failures, retries, or replacements, and the raw dataset was frozen before scientific computation.The frozen analysis ran once against the frozen raw copies.
- Offline reproducibility: The analysis pipeline regenerates every table and figure offline with zero provider calls.
- Public artifact: Code, byte-pinned raw traces, frozen analysis artifacts, and the offline analysis pipeline are released as a public artifact.
- Study separation: Phase 6 and Phase 7 are separate studies and are never pooled.Table 6 summarizes execution and integrity information for the separate phases.
A Phase 7 scenario-level contrast tables
The scenario-level contrast tables report frozen-order persona results, including the confidential-minus-unlabeled, public-minus-unlabeled, and confidential-minus-public comparisons.
- Scenario-level contrasts: Each cell is (k_a−k_b)/4 over four completed repeats, with ten scenario-level values ordered by the frozen design.The ten personas span SaaS support, healthcare billing, finance KYC, employee directories, logistics, telecom, education, payroll, gaming, and procurement.
- Confidential − unlabeled: Table 7 reports Phase 7 scenario-level C−N values, comparing confidential and unlabeled arms.
- Public − unlabeled: Table 8 reports Phase 7 scenario-level P−N values, comparing public and unlabeled arms.
- Confidential − public: Table 9 reports Phase 7 scenario-level C−P values, comparing confidential and public arms.This contrast is recomputed on Phase 7 data.
- Secondary null experiment: All ten per-pair adversarial−benign differences for mutating_tool_requested are 0.000 in the secondary null experiment.Every cell is 0/4 positive, except one attrition-adjusted gpt-5.6-terra cell at 0/3.
B Pinned identifiers
The pinned-identifier materials document the execution environment and machine-generated identifier table.
- Execution environment: The environment used Python 3.12.2 with mcp==2.0.0, openai==3.3.1, and anthropic==1.2.0.
- Pinned identifiers: Table 10 contains machine-generated pinned identifiers, with values wrapped for layout only.