Search papers, labs, and topics across Lattice.
FlowGuard is a novel security detection system for the Model Context Protocol (MCP) that addresses the limitations of existing scanners by focusing on runtime evidence rather than merely semantic signals. It employs a combination of semantic risk triage, recon-guided payload narrowing, and evidence adjudication to effectively identify both execution-related and semantic risks in tool interactions. In evaluations, FlowGuard demonstrated high F1 scores in detecting command injection and file system access vulnerabilities while significantly reducing latency compared to traditional dynamic scanners.
Evidence-grounded detection in FlowGuard reveals that traditional semantic analysis can miss critical execution-related risks, achieving up to 2.23x faster scanning.
The Model Context Protocol (MCP) enables LLM agents to interact with external tools through metadata exchange, tool invocation, and response consumption. Existing MCP security scanners primarily reason about suspicious semantic signals rather than real execution behaviors, which can lead to unreliable risk assessment. For example, credential-like strings may simply be placeholders rather than actual leakage. This gap requires runtime evidence for execution-related risks and careful semantic analysis for risks carried in metadata or returned content. We present FlowGuard, an evidence-grounded MCP security detection system. FlowGuard combines semantic risk triage, recon-guided payload narrowing, schema-valid probe generation, evidence adjudication, and history-guided refinement. It verifies execution-related risks through runtime evidence and detects semantic risks in tool metadata and returned content. We evaluate FlowGuard on an executable benchmark containing 1,880 MCP cases across five vulnerability categories. FlowGuard achieves F1 scores of 0.879 and 0.942 on the execution-related Command Injection and File System Access categories, respectively. Compared with existing dynamic scanners, FlowGuard reduces end-to-end latency by up to 2.23x. In the real-world evaluation, FlowGuard reports 523 findings across 326 servers. These results show that evidence-grounded detection can assess both execution-related and semantic risks in MCP interactions.
