Research
Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
Publication date not yet evaluated · Added · 2 reports acm.org
Page published
Coverage timeline
Why it matters
The confused deputy attack exposes a design-level MCP attack surface at the metadata layer that existing MCP security scanners are architecturally unable to detect, meaning agentic tool ecosystems can be silently hijacked without overtly malicious behavior.
An ACM TOSEM paper uncovers a 'confused deputy attack' against the Model Context Protocol (MCP), where an adversarial server with subtly manipulated metadata covertly overshadows a benign server and intercepts tool invocations. The authors build Puppet, an automated evaluation framework that rewrites tool descriptions via requirement engineering, schema transformation, and name prioritization, and measure tool selection hijacking rates up to 90.89% and end-to-end malicious payload execution up to 86.46% across 14 models, while evading MCP-Scan and McpSafetyScanner.