PaperlayerView exact revision on arXiv

Source-linked AI summary

ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use

Zhiyang Ding, Yang Luo, Guangpu Chen, Qingni Shen, Zhonghai Wu

arXiv:2609.02690v1cs.CR

TL;DR

OAuth authorization does not ensure that later MCP invocations run on the expected, freshly appraised workload. ACLE-MCP binds authorization, appraisal, invocation constraints, and provider-side admission through short-lived leases; the complete design blocks all evaluated attack families while preserving benign tasks.

  • Problem

    OAuth authorization does not imply that a later tool call uses the expected workload, satisfies its assurance policy, or remains sufficiently fresh at execution.

  • Method

    ACLE-MCP issues short-lived, sender-constrained capability leases binding OAuth authority, workload appraisal, invocation constraints, and provider-side admission immediately before execution.

  • Results

    The complete design achieves a 100% blocking rate over attacks expected to be denied and preserves the evaluated benign tasks.

  • Takeaways & Limitations

    Invocation-time binding between call authority and current workload state complements OAuth-protected remote tool use within the evaluated scope.

  • Takeaways & Limitations

    The evaluation covers four benign and six author-constructed misuse families, with simulated sender proof and workload appraisal in the main harness.

Abstract

from arXiv · show

Remote Model Context Protocol (MCP) services enable large language model agents to invoke external tools, but OAuth authorization alone does not ensure that a later tool call is executed by the provider-side workload that the relying party intended to trust. An endpoint may remain authorized even after execution shifts to a substituted workload, relies on stale appraisal state, reuses authority transferred from another sender, or traverses an undeclared downstream component. We call this problem the post-authorization execution trust gap. We present ACLE-MCP, an invocation-scoped architecture that couples delegated authorization, workload appraisal, and resource-side execution admission. For protected calls, ACLE-MCP issues a short-lived, sender-constrained capability lease that binds the expected workload, freshness requirement, operation, object and parameter bounds, downstream constraints, and receipt obligations. A provider-side Execution Gate consumes the lease immediately before protected tool logic begins. We implement a runnable prototype with Keycloak/OIDC validation, an MCP Python SDK server, and an optional vTPM quote-verification backend. Controlled security experiments and an agent tool-use extension show that weaker authorization or connect-time attestation modes leave distinct post-authorization attacks open, whereas full ACLE-MCP blocks all evaluated attack families while preserving all benign tasks. In the locally simulated agent extension, the complete design increases request-level pooled p95 latency on normal allowed calls by 25.7% relative to OAuth-only. These results indicate that invocation-time binding between call authority and current workload state is a practical complement to OAuth-protected remote tool use.

LLM Tool Use

The paper lists Zhiyang Ding, Yang Luo, Guangpu Chen, Qingni Shen, and Zhonghai Wu as its authors.

  • Zhiyang Ding is listed as an author.
  • Yang Luo is listed as an author.
  • Guangpu Chen, Qingni Shen, and Zhonghai Wu are also listed as authors.

Introduction

The paper identifies a post-authorization execution trust gap in remote MCP tool use and proposes ACLE-MCP to bind authorization, workload appraisal, and execution admission at invocation time. It implements and evaluates this architecture across security attacks and agent tool-use scenarios.

  • OAuth authorization does not ensure that a later call runs on the expected, freshly appraised provider workload.
  • ACLE-MCP issues short-lived, sender-constrained leases binding OAuth context, workload appraisal, invocation limits, and provider admission.
  • The prototype validates Keycloak/OIDC tokens, serves MCP calls through a Python SDK server, and optionally verifies vTPM quotes.
  • The evaluation covers replay, workload substitution, stale appraisal, scope misuse, undeclared proxying, receipt violations, and agent tool-use scenarios.

Security Problem

The security problem is the missing invocation-time implication from OAuth authorization to execution by the expected, sufficiently fresh workload within constrained authority. ACLE-MCP addresses this through admission checks, while its guarantees depend on trusted, non-bypassable enforcement components and visible downstream dependencies.

  • OAuth access does not establish the serving workload’s identity, appraisal compliance, or appraisal freshness at execution time.
  • ACLE-MCP confines post-appraisal authority to the approved operation, object, parameters, side effects, and downstream path.
  • The attack classes include credential replay, workload substitution, stale appraisal reuse, invocation-boundary misuse, and undeclared delegation.
  • The model assumes a non-bypassable provider Execution Gate and excludes prompt injection, incorrect Host planning, trusted-component compromise, and hidden dependencies.
  • Host and Provider policies are intersected, with conflicts, missing versions, or downgrades failing closed.

Related Work

Related work addresses adjacent boundaries through agent defenses, delegated authorization and capabilities, and remote attestation or execution control. The paper positions ACLE-MCP at their intersection.

  • Agent-security research studies malicious tool descriptions, outputs, shared state, planning barriers, governance, monitoring, and prompt-injection environments.
  • Authorization and capability systems provide delegated access, structured authorization, sender constraints, stateful policy, and attenuated delegation.
  • Remote-attestation and execution-control systems strengthen workload identity, build provenance, dynamic appraisal, or lower-level confidential-computing protections.

Methodology

ACLE-MCP compiles each invocation into a risk- and policy-bounded request, obtains fresh workload appraisal when required, and issues a short-lived lease consumed by a provider-controlled gate immediately before execution. Enforcement binds sender, workload, request constraints, freshness, downstream scope, and receipt obligations, failing closed when required checks fail.

  • Invocation boundary: The Host refines registered tool policies using the concrete object, parameters, tenant, transmission, administrative scope, tool-chain position, and downstream path.This compilation produces the invocation boundary I_t and minimum workload-assurance requirement ρ.
  • Risk-based enforcement: Risk class determines enforcement: low-risk reads may use OAuth, while medium- and high-risk calls require increasingly narrow, fresh, and potentially single-use leases.Uncertainty can raise the risk class but never automatically downgrade enforcement.
  • Workload appraisal: The Verifier checks workload evidence integrity, nonce and time freshness, measurements, and Provider policy before issuing a signed appraisal result.The result identifies the workload and bounds its validity interval; raw evidence may remain within the Provider–Verifier boundary.
  • Lease issuance: The lease issuer combines the invocation boundary, signed appraisal, verified OAuth context, sender identity, and policy constraints into a short-lived capability lease.The lease binds workload identity, operation and object scope, parameter bounds, side-effect budget, downstream constraints, freshness, policy versions, receipt obligations, and expiration.
  • Execution admission: The Execution Gate sits before the protected handler and validates credentials, sender binding, workload identity, freshness, request and state constraints, and required receipts before admitting execution.The gate must be controlled by the Provider or platform boundary, prevent alternate paths, and fail closed when validation or policy checks fail.
  • Downstream enforcement: Declared downstream constraints limit chained workflows to dependencies visible to enforcement, requiring separate leases or explicit inclusion in an authorized downstream set.Receipts support accountability for high-impact operations but cannot undo external side effects or prove arbitrary program semantics.

Evaluation

The evaluation tests whether invocation-time workload binding closes post-authorization attacks, identifies necessary mechanisms, and measures integration and runtime costs. Full ACLE-MCP blocks all evaluated attack families while preserving benign tasks, with a 25.7% pooled p95 increase over OAuth-only in the agent extension.

  • Evaluation: The evaluation examines security effectiveness, mechanism attribution, and prototype integration cost across controlled services, enforcement modes, and agent tasks.The study addresses RQ1–RQ3 using separate Verifier, lease-issuer, Execution Gate, MCP tool, and adversarial-workload services.
  • Evaluation: Five modes compare bearer authorization, connect-time attestation, stateful least privilege, capability-only enforcement, and full ACLE-MCP.The modes differ in workload appraisal, sender proof, invocation bounds, and resource-side state checks.
  • Security effectiveness: OAuth-only and connect-time attestation admit replay, workload substitution, stale appraisal, undeclared proxying, and receipt violations because they lack invocation-time appraisal binding at the gate.These results isolate the post-authorization trust gap that the resource-side Execution Gate is intended to close.
  • Security effectiveness: All five modes achieve 100% benign-task success and zero false positives, while full ACLE-MCP blocks every evaluated execution-misuse scenario with zero false negatives.The agent extension covers four benign task families and six attack families, repeated ten times under each mode.
  • Runtime cost: 25.7% is the relative increase in request-level pooled p95 latency for normal allowed agent calls, from 12.20 ms with OAuth-only to 15.34 ms with the complete mechanism.This local result uses a warm-cache simulated Verifier path and excludes cold-cache, real JWKS, and hardware-attestation costs.
  • Mechanism attribution: 100% blocking rate is achieved by full ACLE-MCP, whereas removing sender proof, freshness, downstream constraints, or receipt validation reopens corresponding attack classes.Removing Attested Step-Up jointly removes workload-binding checks; all security ablations retain 100% benign-task success.
  • Runtime cost: Disabling the appraisal-result cache preserves security outcomes but increases Verifier calls from 27 to 210 and normal pooled p95 latency from 21.84 ms to 23.45 ms.The increase is approximately 7.4%, showing the cache is a performance optimization rather than a security requirement.
  • Mechanism attribution: A 50 ms appraisal-freshness window blocks all modeled TOCTOU cases, while blocking falls to 0.60 at 500 ms and zero at 5000 ms.The 50 ms window averages 10.2 Verifier calls with a cache-hit ratio of 0.5143; wider windows reduce verification pressure but increase exposure.

Discussion

ACLE-MCP’s guarantees depend on a non-bypassable provider-side Execution Gate and are limited to a prototype security scope rather than a complete trust framework or production-ready system.

  • ACLE-MCP fails if an attacker controls the Execution Gate or all routing paths, because protected requests can bypass admission enforcement.
  • The architecture excludes prompt injection, incorrect Host-side planning, and compromise of the Verifier or lease issuer.
  • The evaluation covers four benign and six author-constructed misuse families, with simulated sender proof and workload appraisal in the main harness.
  • Receipts cannot undo external side effects, and downstream guarantees cover only declared or mediated dependencies.
  • The results demonstrate prototype-level feasibility rather than production readiness.

Conclusion

The paper addresses the post-authorization execution trust gap by binding delegated authority to freshly appraised workload state at the invocation boundary. Its complete design preserves evaluated benign tasks and blocks all evaluated attack families, supporting a narrow conclusion for high-risk remote tool calls.

  • OAuth authorization does not ensure that a later invocation reaches the expected and freshly appraised provider-side workload.
  • ACLE-MCP issues a short-lived, sender-constrained capability lease consumed immediately before protected tool logic begins.
  • The complete design preserves evaluated benign tasks and blocks all evaluated attack families, unlike authorization-only, connect-time attestation, Stateful policy, and Capability-only designs.
  • For high-risk remote tool calls, workload trust must be checked when delegated authority is actually consumed.
Loading 2609.02690v1…