Reproduce “Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Charoes Huang, Xin Huang, Ngoc Phu Tran, Amin Milani Fard
This research details client-side security vulnerabilities within the Model Context Protocol (MCP), specifically analyzing "tool poisoning" prompt injection attacks. An empirical evaluation of seven prominent MCP client implementations revealed varying security postures, with some being highly susceptible to credential theft, surveillance, phishing, and remote code execution via malicious tool descriptions, while others demonstrated robust defensive capabilities.
Key insights
- Client-side vulnerabilities in the MCP ecosystem, particularly tool poisoning, pose critical risks, confirmed by a DREAD score of 46.5/50, enabling unauthorized data access and remote code execution.
- A significant disparity exists in the security postures of major MCP clients; some were found to be completely vulnerable to all tested attacks, while others successfully blocked them.
- Effective client-side security relies on robust static validation of server-provided tool metadata, clear and comprehensive user interfaces, and the implementation of sandboxed execution environments.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.