58 results for “Model Context Protocol”

Rohan Paul's X post summarizes the paper "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol", from TikTok researchers. It reports that MCP-using agents often finish the requested task, then quietly call an attacker-controlled logging tool that records the query, server reply and final answer. The attack works through natural-language tool descriptions that agents read when choosing and ordering tools. The visible text is truncated.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

Log-To-Leak is an arXiv paper (cs.CR, cs.AI) by Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du on prompt injection attacks against tool-using LLM agents through the Model Context Protocol. The title points to a logging-based data leakage channel. The fetched page holds only the title, authors and arXiv link, with no abstract, so the method and results are not visible here.

x.compaperAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

Thread by Kizuno18 on the move from local stdio/Docker Model Context Protocol servers to remote HTTP/SSE endpoints in enterprise infrastructure. It names three trade-offs: credential boundary inversion (short-lived OAuth/JWT tokens instead of long-lived admin tokens on workstations), tool schema bloat solved by deferred discovery, and governance via HCP Terraform policy-as-code (Sentinel/OPA), audit trails and approvals. It is opinion, with no data or implementation detail.

x.comthreadAdded 29 Oct 2026, published 27 Oct 2026🛡️ Security

Kizuno18's X post argues that the move from local stdio and Docker MCP servers to remote HTTP/SSE endpoints matures the Model Context Protocol in enterprise infrastructure. It lists three trade-offs: short-lived OAuth/JWT bearer tokens replace mounted admin credentials, deferred tool discovery avoids roughly 20k tokens of eager schema loading, and HCP Terraform enforces Sentinel/OPA policy, audit trails and approvals server-side. Opinion post with no benchmarks or code.

x.comthreadAdded 29 Oct 2026, published 27 Oct 2026🧠 AI

Log-To-Leak is a prompt-injection attack on tool-using LLM agents that abuses Model Context Protocol tool metadata to trigger an attacker-controlled logging call after the last legitimate call, leaking the user query, server name, server response and agent response. Evaluated on five MCP servers and four agents, it reaches 62.64-100% attack success with 76.55-95.64% logging accuracy. Three defenses leave over 55% residual ASR on GitHub MCP with GPT-4o.

arxiv.orgpaperAdded 28 Oct 2026, published 26 Oct 2026🛡️ Security

5ire is a desktop AI assistant and MCP client that connects to OpenAI, Anthropic, Google, Mistral, Grok, DeepSeek and Ollama from one window. It has a local knowledge base and tool calls over Model Context Protocol. The tools feature needs Python, Node and uv installed because it runs a local MCP server; without them it works only as a chat client.

x.comthreadAdded 25 Oct 2026, published 24 Oct 2026🧠 AI

A post by BIGBULLapp on X about a TensorBlock GitHub index of Model Context Protocol servers, described as a TypeScript list so agents call tools someone has already wired up. It cites 1470 forks, 943 stars and 15 open issues. The author notes that curated lists go stale when a server changes its schema. The repository name is truncated in the post.

x.comthreadAdded 24 Oct 2026, published 23 Oct 2026🧠 AI

MCP-Injector is a protocol-aware fault-injection middleware for Model Context Protocol tool calls, with permanent, transient and intermittent faults on seedable schedules. Its fault model comes from 57,240 issue and PR threads across 1,774 open-source MCP repositories. In a 1,350-cell experiment, faults cut task-completion score by 60% (8.08 to 3.23 of 10), and the 120B gpt-oss model was no more resilient than the 20B. Agent stacks differed in how well they absorbed faults.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

Decode-time provenance binding is a defense for Model Context Protocol agent pipelines against cross-modal trust laundering, where instructions hidden in an email-signature image via LSB, DCT or metadata steganography get decoded by a tool. It combines HMAC-authenticated trust labels, a provenance ledger and context-taint tracking to block critical tool calls. On a real MCP testbed with 24 adaptive payloads, attack success fell from 100% undefended (62.5% for keyword and regex filters) to 0%.

arxiv.orgpaperAdded 26 Oct 2026, published 22 Oct 2026🛡️ Security

OWASP MCP Security Testing Guide is a living, GPL-3.0 collection treating the Model Context Protocol as a security boundary from user through model, MCP client, MCP server and tool to the target system. It covers threats, secure development, host/client controls, supply chain, enterprise gateways, detection, incident response, taxonomy, public incidents, case studies and review checklists, with 79 tests in Chapter 3 (sections 3.1–3.19). It includes a finding template, and it links the MCP Goat lab for safe practice. It is useful to AppSec, red team and SOC people assessing MCP deployments.

github.comrepoAdded 17 Oct 2026🛡️ Security

Decrypt reports on StepFun's STEPX Neo phone (3,999 yuan, launched Oct. 13), which runs Step AOS 1.0, an OS built around a system-level agent called Amoo. Phone functions are exposed as small blocks the agent calls via Model Context Protocol. Amoo keeps separate user and task-learning memories, runs simple commands on a small on-device model and sends harder multi-app requests to a larger cloud model. Nearly 100 partners including Alipay, Tencent and Meituan handle payments and bookings on their own platforms, unlike the screen-reading approach of ByteDance's Doubao agent. The article also covers StepFun's Step 5 Preview (600B parameters, 27B active, 1M-token context) and the open-source Step 3.5 Flash.

decrypt.coarticlePublished and added 17 Oct 2026🧠 AI

Tweet announcing that the MCP Adapter is now a canonical plugin on WordPress.org (version 0.7.0). It bridges the WordPress Abilities API to the Model Context Protocol, with a default server at /wp-json/mcp/mcp-adapter-default-server. Only abilities a site marks public are exposed, so the security review comes down to auditing the ability list.

x.comthreadAdded 16 Oct 2026, published 15 Oct 2026🧠 AI

Presents ChainGraph, a pattern that externalizes exploit-chain reasoning for LLM pentest agents (Claude Code, Codex) into a Neo4j property graph exposed via the Model Context Protocol. Findings, attack steps, credentials, assets and tamper-evident evidence receipts are typed nodes with pre/post-condition edges, queried with Cypher and Graph Data Science for next-step inference, entry-to-crown-jewel pathing, chain-severity promotion, provenance and chokepoints. On a synthetic GOAD-style multi-forest Active Directory engagement, three Medium findings become Critical once chained, betweenness centrality identifies break-points, and reasoning payload drops ~98% (token proxy); results are single-run and illustrative.

arxiv.orgpaperAdded 17 Oct 2026, published 14 Oct 2026🛡️ Security

Social thread reacting to a newly disclosed high-severity OAuth vulnerability in the Model Context Protocol Python SDK, where a malicious MCP server could manipulate the authorization flow and steal credentials used by an agent. The author uses it to argue that delegated agent authority needs provenance (who granted it, to which agent, for which service and resource, whether it is transferable or replayable, and when it expires) and that machine-to-machine trust must be auditable by humans. Gives no CVE ID or technical exploit detail.

x.comthreadAdded 13 Oct 2026, published 12 Oct 2026🛡️ Security

A tweet from @Xidea404 pointing to the ADI Chain MCP Server documentation on docs.adi.foundation. The server lets AI agents interact with the ADI blockchain through the Model Context Protocol. The tweet carries no technical detail itself, so what the server exposes can't be confirmed from it. It is a pointer to a blockchain-specific MCP connector.

x.comthreadPublished and added 12 Oct 2026🧠 AI

Official changelog for the Model Context Protocol 2026-07-28 specification. Major changes: protocol-level sessions and the initialize handshake are removed to make MCP stateless, with version and capabilities carried in _meta on every request, plus a new server/discover RPC and subscriptions/listen replacing the GET stream and resource subscribe calls. It introduces Multi Round-Trip Requests (InputRequiredResult) in place of server-initiated sampling, roots and elicitation requests, moves tasks into an extension, and deprecates Roots, Sampling, Logging, HTTP+SSE and Dynamic Client Registration. Minor changes add cache hints (ttlMs/cacheScope), new Mcp-Method/Mcp-Name headers, OpenTelemetry trace context, RFC 9207 iss validation and an error-code allocation policy.

modelcontextprotocol.ioadvisoryAdded 10 Oct 2026🧠 AI

GitHub release announcing the stable 2026-07-28 revision of the Model Context Protocol specification, published from the modelcontextprotocol/modelcontextprotocol repository. The release page itself only points to the official MCP website for the spec and to a changelog for the detailed changes. It matters as the canonical version marker that MCP client, server and SDK implementers track for protocol changes.

github.comadvisoryAdded 9 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that adds cryptographically signed and versioned tool definitions, OAuth 2.0 scope-based permissions, Cedar-policy-driven context-aware access control (via engines like Amazon Verified Permissions/OPA), and call-stack verification to stop tool chaining and privilege escalation. It is designed to counter two named MCP threat classes — Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (post-approval silent modification of tool behavior) — with concrete pseudocode for signature verification, version/integrity checking, and policy evaluation. The page functions as an implementation guide for MCP client/server builders wanting to harden tool approval and invocation flows.

vulnerablemcp.infowriteupAdded 8 Oct 2026🧠 AI

Decrypt reports on Google Cloud's newly announced Gemini Agent, a long-running AI agent that operates across Gmail, Docs, Sheets, Slides, Drive, Chat, Calendar, Microsoft 365 and Slack, and can run for hours or days on a single goal. The feature allows managers to spin up coworker agents with their own Workspace email address, calendar, Drive storage and directory listing, each given a cryptographically attested identity and a separate audit trail; agents connect to Salesforce, ServiceNow, Jira, Snowflake, BigQuery and any Model Context Protocol server, and are orchestrated across both Gemini and Anthropic's Claude models depending on cost and quality fit. Google pairs the launch with safety infrastructure, an Agent Sandbox, an AI network firewall called Agent Gateway, and real-time token-spend caps, citing a prior Claude Cowork VM-escape finding by Accomplish AI as the kind of containment failure it is designed to prevent.

decrypt.coarticlePublished and added 8 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that defends against Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (silent post-approval modification of tool behavior) using cryptographic signing of tool definitions, immutable versioning with mandatory re-approval, OAuth 2.0 scopes, and Cedar/Amazon Verified Permissions-based policy-aware access control. The page includes detailed attack scenarios, a call-stack verification scheme to prevent tool-chaining privilege escalation, and implementation code for key management, signature verification, and policy evaluation.

vulnerablemcp.infowriteupAdded 8 Oct 2026🛡️ Security

The preprint tests whether security requirements from a governed security-by-design knowledge base (SbD-ToE), delivered to a code generator through a Model Context Protocol server at generation time, make AI-written code more secure. On DualGauge (59 Python tasks, LLM-judge scoring) the share of tasks passing all security tests rose from 44.1% to 78.0%. On BaxBench (28 backend scenarios with real exploits in containers) the share of functionally correct solutions with no successful exploit rose from 65% to 86%, comparable to the authors' Oracle Security Reminder (85%). The pre-specified joint secure-and-functional metric did not improve significantly, and the stricter code failed functional tests that fix values the task never states. The study used one model and one generation per task. The authors argue that current benchmarks only detect the weaknesses their evaluators were built for, and propose measuring conformance with the requirements that apply.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🧠 AI

The Vulnerable MCP Project is a curated, continuously growing database of security vulnerabilities and attack techniques specific to the Model Context Protocol ecosystem. Entries cover concrete CVEs (e.g. CVE-2025-68143/68144/68145 in Anthropic's mcp-server-git), transport-layer SDK flaws (cross-client response leakage, missing DNS rebinding protection in the official TypeScript/Python SDKs), unauthenticated/0.0.0.0-bound servers enabling RCE (MCPJam inspector, MCP Inspector, Grafana MCP), command/path injection in dozens of third-party servers (gemini-mcp-tool, mcp-server-kubernetes, Framelink Figma MCP, Zen MCP, filesystem-mcp), SSRF chains reaching cloud metadata (MarkItDown MCP, mcp-fetch-server), and a large set of AI-specific attacks: tool poisoning, trigger-phrase data exfiltration, prompt injection via GitHub issues, Jira and Google Docs, rug-pull tool mutation, and cross-server tool-name collisions. It functions as the de facto vulnerability registry for the MCP ecosystem, useful for tracking disclosed issues before patching or adopting third-party MCP servers.

vulnerablemcp.inforepoAdded 6 Oct 2026🛡️ Security

The GitHub releases page for the modelcontextprotocol/modelcontextprotocol repository, listing the version history of the Model Context Protocol (MCP) specification from its initial 2024-10-07 draft through the 2025-03-26, 2025-06-18, and 2025-11-25 revisions to the newly stabilized 2026-07-28 revision. Each entry links to its changelog and distinguishes release candidates from final/stable releases, and the page points to the version-negotiation documentation that lets clients and servers agree on which protocol revision to use.

github.comotherAdded 5 Oct 2026🧠 AI

COPEX (COntext Provider EXploitation) is a benchmark that isolates the tool-selecting LLM as the unit of evaluation in Model Context Protocol systems, fixing the surrounding agent stack and varying only the model to measure its intrinsic susceptibility to adversarial context. It covers 25 attack types across 125 scenarios spanning four entry surfaces — model/agent, client, server/tool, and transport — and tests nine models across 3,375 trials, finding a mean attack success rate of 64.4% (58.3%–71.4% by surface); combined input and context scanning cut mean attack success by 49.6% on an eight-attack defense subset. The work separates "system exposure" (attacks succeeding outside the model's observation/control) from "model susceptibility," and the benchmark itself is released publicly.

arxiv.orgpaperAdded 6 Oct 2026, published 3 Oct 2026🛡️ Security

CyTReX is a proposed explainable-AI framework for Distributed Energy Resource (DER) network security that converts edge anomaly-detector alerts into ranked, evidence-traceable threat hypotheses for SOC analysts. It builds a structured "evidence packet" combining edge anomaly detection outputs, cloud-layer attack interpretation, SHAP feature attributions, surrogate decision rules, and Model Context Protocol-enabled cyber threat intelligence enrichment, constraining LLM reasoning so every ranked hypothesis and attack-tree branch is traceable to explicit evidence rather than free-form inference. The authors evaluate five pipeline configurations and show that adding reasoning components improves hypothesis specificity and evidence traceability for SOC triage/investigation.

arxiv.orgpaperAdded 6 Oct 2026, published 3 Oct 2026🛡️ Security

Bifrost is an open-source, high-performance LLM gateway (by Maxim AI) that exposes a single OpenAI-compatible API across 23+ providers including OpenAI, Anthropic, AWS Bedrock, Google Vertex, Azure, Cohere, Mistral, and Ollama. It provides automatic failover, load balancing, semantic caching, Model Context Protocol (MCP) tool integration, budget and governance controls, OIDC user provisioning, and Prometheus-based observability, deployable via npx or Docker with claimed sub-15 microsecond overhead at 5,000 RPS. It is positioned as a drop-in replacement requiring only a base-URL change for existing OpenAI, Anthropic, or GenAI SDK code.

github.comrepoAdded 2 Oct 2026🧠 AI

Release notes for v2.2.0 of the official Model Context Protocol TypeScript SDK. Upgrade notes: machine-to-machine OAuth providers (ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider, CrossAppAccessProvider) should now be given expectedIssuer, and fetchToken() throws AuthorizationServerMismatchError when client information is bound to a different authorization server. listTools/listPrompts/listResources/listResourceTemplates now follow nextCursor automatically, capped by listMaxPages. Fixes include CommonJS type-checking of the DPoP jose types, unhandled rejections in Client.listen(), createMcpHandler stack overflow and subscriptions/listen handling, .localhost loopback for OAuth token endpoints, and v1-to-v2 codemod comment preservation.

github.comadvisoryAdded 1 Oct 2026🧠 AI

A whitepaper from the OpenID Foundation, led by Tobin South with contributors from WorkOS, Stanford's Loyal Agents Initiative, and the Artificial Intelligence Identity Management Community Group, mapping how authentication and authorization standards apply to AI agents. It surveys current fixes (OAuth 2.1, Model Context Protocol authorization, enterprise SSO/SCIM provisioning, IPSIE profiles) and lays out unsolved problems for autonomous agents: delegated "on-behalf-of" identity versus user impersonation, consent fatigue at scale, recursive sub-agent delegation, multi-user shared agents, and browser/computer-use agents that bypass API-based authorization entirely.

openid.netpaperAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

Blockworks, a crypto research and data provider, launched a hosted Model Context Protocol server that gives AI agents like ChatGPT, Claude and Cursor read access to the datasets underlying its research and its Intel app. The MCP server is included free with every existing API plan and uses the same API key and permission scope as the regular API, rather than requiring separate onboarding.

thedefiant.ioarticlePublished and added 1 Oct 2026🧠 AI

The official Ruby SDK for the Model Context Protocol (the mcp gem) became the sixth Tier 1 MCP SDK in September 2026, after TypeScript, Python, C#, Go and Rust. Version 1.2.0 supports the 2026-07-28 spec revision, including the stateless lifecycle, multi round-trip requests and cache hints. The SDK passes 67/67 server and 50/50 client conformance runs, and the post gives install and upgrade steps.

blog.modelcontextprotocol.ioarticleAdded 30 Oct 2026, published 29 Sep 2026🧠 AI