Search papers, labs, and topics across Lattice.
This paper introduces ACLE-MCP, an architecture designed to address the post-authorization execution trust gap in remote model context protocol services for large language model agents. By implementing a short-lived, sender-constrained capability lease that binds various operational parameters and constraints, the system ensures that tool calls are executed by the intended workload, effectively blocking all evaluated post-authorization attacks while maintaining benign task performance. The experimental results demonstrate that while ACLE-MCP increases latency by 25.7% compared to OAuth-only systems, it significantly enhances security in remote tool use scenarios.
Invocation-time binding of call authority to workload state effectively eliminates post-authorization attacks, a critical vulnerability in remote LLM tool use.
Remote Model Context Protocol (MCP) services enable large language model agents to invoke external tools, but OAuth authorization alone does not ensure that a later tool call is executed by the provider-side workload that the relying party intended to trust. An endpoint may remain authorized even after execution shifts to a substituted workload, relies on stale appraisal state, reuses authority transferred from another sender, or traverses an undeclared downstream component. We call this problem the post-authorization execution trust gap. We present ACLE-MCP, an invocation-scoped architecture that couples delegated authorization, workload appraisal, and resource-side execution admission. For protected calls, ACLE-MCP issues a short-lived, sender-constrained capability lease that binds the expected workload, freshness requirement, operation, object and parameter bounds, downstream constraints, and receipt obligations. A provider-side Execution Gate consumes the lease immediately before protected tool logic begins. We implement a runnable prototype with Keycloak/OIDC validation, an MCP Python SDK server, and an optional vTPM quote-verification backend. Controlled security experiments and an agent tool-use extension show that weaker authorization or connect-time attestation modes leave distinct post-authorization attacks open, whereas full ACLE-MCP blocks all evaluated attack families while preserving all benign tasks. In the locally simulated agent extension, the complete design increases request-level pooled p95 latency on normal allowed calls by 25.7% relative to OAuth-only. These results indicate that invocation-time binding between call authority and current workload state is a practical complement to OAuth-protected remote tool use.
