VIPER-MCP paper

What it is

VIPER-MCP (arXiv:2605.21392, v2 Aug 2026), an end-to-end automated auditing framework for Model Context Protocol servers. The threat it targets: MCP tool handlers expose privileged operations — shell execution, network access, file-system manipulation — to agent-driven invocation, so a flawed handler creates a direct taint path from natural-language input to a security-sensitive sink, yielding RCE or full system compromise. The paper claims to be the first framework that both detects these taint-style flaws and dynamically confirms them with concrete proof-of-concept prompts (all 106 findings were confirmed via end-to-end exploit traces, not just static alerts).

How it works

Two techniques the summary names but does not unpack:

• Anchor-query pass (the second pass of its two-pass static analysis): augments standard taint alerts with function-level structural context, resolving file-level static artifacts down to the specific MCP tool handler and producing vulnerability-anchored call chains. This is what distinguishes it from tools that emit unconfirmed file-scoped alerts.
• Feedback-driven prompt evolution: dual-mutator scheduling that separately corrects tool-selection drift (the agent invoking the wrong tool) and deepens parameter penetration (shaping args to reach the sink), combined with fitness-scored seed selection to iteratively refine natural-language prompts toward the vulnerable sink. This targets flaws needing specific parameter shapes or multi-step taint paths that fixed template libraries miss.

What to do

If you ship or run an MCP server exposing shell/network/filesystem sinks to tool handlers, treat natural-language tool arguments as untrusted taint sources reaching those sinks. No CVE IDs, patches, or affected package list are given on this page — the 67 assigned CVEs are referenced but not enumerated; the PDF would be needed to map them.