Search papers, labs, and topics across Lattice.
This paper introduces MCPShield, a security cognition layer designed to address the implicit trust that LLM-based agents place in potentially untrusted Model Context Protocol (MCP) servers. MCPShield employs metadata-guided probing before tool invocation, runtime execution monitoring within controlled boundaries, and post-invocation reasoning over historical traces to update security cognition. Experiments demonstrate MCPShield's effectiveness in defending against novel MCP-based attacks across various agentic LLMs with low overhead and minimal false positives.
LLM agents blindly trust third-party tools, but MCPShield adds a "security cognition" layer that learns to spot malicious servers before they can do damage.
The Model Context Protocol (MCP) standardizes tool use for LLM-based agents and enable third-party servers. This openness introduces a security misalignment: agents implicitly trust tools exposed by potentially untrusted MCP servers. However, despite its excellent utility, existing agents typically offer limited validation for third-party MCP servers. As a result, agents remain vulnerable to MCP-based attacks that exploit the misalignment between agents and servers throughout the tool invocation lifecycle. In this paper, we propose MCPShield as a plug-in security cognition layer that mitigates this misalignment and ensures agent security when invoking MCP-based tools. Drawing inspiration from human experience-driven tool validation, MCPShield assists agent forms security cognition with metadata-guided probing before invocation. Our method constrains execution within controlled boundaries while cognizing runtime events, and subsequently updates security cognition by reasoning over historical traces after invocation, building on human post-use reflection on tool behavior. Experiments demonstrate that MCPShield exhibits strong generalization in defending against six novel MCP-based attack scenarios across six widely used agentic LLMs, while avoiding false positives on benign servers and incurring low deployment overhead. Overall, our work provides a practical and robust security safeguard for MCP-based tool invocation in open agent ecosystems.
