MCP-Guard: A Defense Framework for Model Context Protocol Integrity in Large Language Model Applications

2025-08-14

AI Summary

To address security threats—including prompt injection and data leakage—arising when large language models (LLMs) invoke external tools via the Model Context Protocol (MCP), this paper proposes a layered defense framework ensuring contextual integrity. Methodologically, we design a three-stage detection pipeline: static scanning, deep semantic analysis, and lightweight LLM-based arbitration; innovatively integrating rule-based analysis, a fine-tuned E5 embedding model (96.01% accuracy), and GPT-4–enhanced generation of realistic-synthetic hybrid attack samples. Our key contributions are: (1) MCP-AttackBench—the first large-scale, MCP-specific attack benchmark, comprising over 72,000 samples covering diverse real-world attack vectors; (2) a lightweight detection paradigm achieving both high accuracy and low false-positive rates; and (3) advancement of standardized security evaluation for MCP deployments.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness
• Computer Vision: Large Vision Models

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information

Abstract

The integration of Large Language Models (LLMs) with external tools via protocols such as the Model Context Protocol (MCP) introduces critical security vulnerabilities, including prompt injection, data exfiltration, and other threats. To counter these challenges, we propose MCP-Guard, a robust, layered defense architecture designed for LLM--tool interactions. MCP-Guard employs a three-stage detection pipeline that balances efficiency with accuracy: it progresses from lightweight static scanning for overt threats and a deep neural detector for semantic attacks, to our fine-tuned E5-based model achieves (96.01) accuracy in identifying adversarial prompts. Finally, a lightweight LLM arbitrator synthesizes these signals to deliver the final decision while minimizing false positives. To facilitate rigorous training and evaluation, we also introduce MCP-AttackBench, a comprehensive benchmark of over 70,000 samples. Sourced from public datasets and augmented by GPT-4, MCP-AttackBench simulates diverse, real-world attack vectors in the MCP format, providing a foundation for future research into securing LLM-tool ecosystems.

Problem

• Defends against security vulnerabilities in LLM-tool interactions
• Detects prompt injection and data exfiltration attacks
• Provides a benchmark for evaluating LLM security defenses

Innovation

• Three-stage detection pipeline for threats
• E5-based model for adversarial prompt identification
• Lightweight LLM arbitrator minimizes false positives