Search papers, labs, and topics across Lattice.
This paper introduces a layer-aligned taxonomy for Model Context Protocol (MCP) security, organizing attacks based on the architectural component responsible for enforcement across six MCP layers. It maps existing defenses onto this framework, revealing uneven protection concentrated at the tool level, with gaps in host orchestration, transport, and supply-chain layers. The analysis suggests that MCP security weaknesses arise from architectural misalignment rather than isolated implementation flaws, highlighting the need for a defense-in-depth strategy.
Current defenses for LLM-based agent systems are heavily biased towards securing the tools themselves, leaving critical vulnerabilities unaddressed in orchestration, transport, and supply chain layers.
The Model Context Protocol (MCP) enables large language models (LLMs) to dynamically discover and invoke third-party tools, significantly expanding agent capabilities while introducing a distinct security landscape. Unlike prompt-only interactions, MCP exposes pre-execution artifacts, shared context, multi-turn workflows, and third-party supply chains to adversarial influence across independently operated components. While recent work has identified MCP-specific attacks and evaluated defenses, existing studies are largely attack-centric or benchmark-driven, providing limited guidance on where mitigation responsibility should reside within the MCP architecture. This is problematic given MCP's multi-party design and distributed trust boundaries. We present a defense-placement-oriented security analysis of MCP, introducing a layer-aligned taxonomy that organizes attacks by the architectural component responsible for enforcement. Threats are mapped across six MCP layers, and primary and secondary defense points are identified to support principled defense-in-depth reasoning under adversaries controlling tools, servers, or ecosystem components. A structured mapping of existing academic and industry defenses onto this framework reveals uneven and predominantly tool-centric protection, with persistent gaps at the host orchestration, transport, and supply-chain layers. These findings suggest that many MCP security weaknesses stem from architectural misalignment rather than isolated implementation flaws.
