Skip to content

The Vulnerable MCP Project — MCP vulnerability database

site🛡️ Securityvulnerablemcp.info ↗

1 post in the catalog

A site with no feed of its own. Its index page is checked for new posts, which are read the same way. What Trove read and did not keep stays on file, not shown.

vulnerablemcp.infowriteup

ETDI: Comprehensive MCP Security Framework

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that defends against Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (silent post-approval modification of tool behavior) using cryptographic signing of tool definitions, immutable versioning with mandatory re-approval, OAuth 2.0 scopes, and Cedar/Amazon Verified Permissions-based policy-aware access control. The page includes detailed attack scenarios, a call-stack verification scheme to prevent tool-chaining privilege escalation, and implementation code for key management, signature verification, and policy evaluation.

Model Context ProtocolOAuthETDI+2
Tool PoisoningRug Pull attackCall Stack Verification

AI Security