Incomplete MCP Tool-Call Attack Detection

Description

The MTGuard study evaluates unsafe Model Context Protocol tool calls originating from compromised server data, host-side execution changes, and malicious user-controlled resources. Its hybrid monitor combines pre-execution parameter inspection, behavioral observation, and post-execution result verification across browser-automation and financial-analysis agents.

Examples

Evaluate using mocked MCP tools, synthetic credentials, controlled browser and financial tasks, inert service effects, and independently labeled unsafe calls; see https://arxiv.org/html/2607.25297 (opens in a new tab).

Impact

Across 99 instrumented cases and 240 confirmed unsafe tool calls, MTGuard flags 116 calls (48.3%), compared with 20 calls (8.3%) for the stronger tested baseline. The experiment records denial decisions counterfactually while still allowing calls to execute, and some detections occur after the side effect; these results establish detection on collected traces, not demonstrated prevention or rollback.

Affected Systems

• Browser-automation and financial-analysis agents using Model Context Protocol tools
• MCP servers, MCP hosts, tool metadata, declared tool arguments, execution hooks, and tool results
• MTGuard, Tool Call Governance, and Tool Result Inspection benchmark configurations

Mitigation Steps

• Enforce trusted pre-execution authorization checks on actual tool names, arguments, destinations, and user-approved scope.
• Compare declared tool invocations with observed runtime behavior to detect host-side substitution or execution-layer tampering.
• Treat MCP server metadata and tool results as untrusted inputs with explicit provenance boundaries.
• Block unsafe calls before irreversible side effects; do not mistake post-execution detection or counterfactual denial for prevention.
• Measure residual missed-call rates, false positives, latency, and attack-surface-specific coverage before deployment.

Evidence

• https://arxiv.org/html/2607.25297 (opens in a new tab) — Threat model and Section 4 describe server-side, host-side, and user-side attacks across 99 instrumented browser and financial cases.
• https://arxiv.org/html/2607.25297 (opens in a new tab) — Table 1 directly identifies GPT-5.6 Luna, DeepSeek-V4-Flash, and DeepSeek-V4-Pro as the evaluated agent backbones.
• https://arxiv.org/html/2607.25297 (opens in a new tab) — Section 4.2 reports 116/240 unsafe calls detected by MTGuard versus 20/240 for Tool Call Governance.
• https://arxiv.org/html/2607.25297 (opens in a new tab) — Section 4.2 states that denial decisions did not block tool execution or modify results and were recorded only as counterfactual enforcement verdicts.
• https://arxiv.org/html/2607.25297 (opens in a new tab) — Methodology explains that post-execution denial cannot roll back side effects that have already completed.