Trust Boundaries in the Model Context Protocol: Tool Poisoning, Server Impersonation, and Mitigations
DOI:
https://doi.org/10.15662/IJEETR.2024.0606036Keywords:
Model Context Protocol, tool poisoning, prompt injection, server impersonation, confused deputy, trust boundary, agent security, large language model tool use, sandboxingAbstract
The Model Context Protocol, MCP, standardizes how applications that embed large language models connect to external tools, data sources, and services, letting a single host application discover and invoke capabilities exposed by any number of independent servers at runtime. This standardization brings real benefits, including interoperability across vendors and a growing ecosystem of reusable integrations, but it also introduces trust boundaries that did not exist in earlier, more tightly coupled integration patterns, and the protocol's initial design did not fully anticipate how an adversarial party could exploit those boundaries. This article examines three specific classes of risk that have emerged in practice: tool poisoning, in which a server embeds hidden instructions inside a tool's description that manipulate the connected model without the end user's awareness; server impersonation and tool shadowing, in which a malicious server exploits naming collisions or identity ambiguity to intercept or redirect calls intended for a legitimate server; and supply chain and execution risk arising from the common practice of running locally distributed server code with the host application's own privileges. Drawing on the protocol specification, prior research on indirect prompt injection and the classical confused deputy problem, and early security disclosures published through the first half of 2025, this article maps these risks onto the protocol's actual trust boundaries, presents experimental attack success and mitigation effectiveness results across a simulated multi server deployment, and proposes a defense in depth architecture combining tool description sanitization, cryptographic server identity verification, and permission scoped sandboxing. The article closes with a decision framework for teams building or operating applications that connect large language models to external tools through this protocol.
References
1. Anthropic. (2024). Model Context Protocol Specification.
2. Arbaugh, W. A., Farber, D. J., and Smith, J. M. (1997). A Secure and Reliable Bootstrap Architecture. Proceedings of the IEEE Symposium on Security and Privacy.
3. Denniss, W., and Bradley, J. (2017). OAuth 2.0 for Native Apps. RFC 8252, Internet Engineering Task Force.
4. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., and Fritz, M. (2023). Not What You've Signed Up For: Compromising Real World LLM Integrated Applications with Indirect Prompt Injection. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security.
5. Hardt, D. (2012). The OAuth 2.0 Authorization Framework. RFC 6749, Internet Engineering Task Force.
6. Hardy, N. (1988). The Confused Deputy: (or why capabilities might have been invented). ACM SIGOPS Operating Systems Review, volume 22.
7. Invariant Labs. (2025). MCP Security Notification: Tool Poisoning Attacks.
8. Liu, Y., Deng, G., Li, Y., Wang, K., Zhang, T., Liu, Y., Wang, H., Zheng, Y., and Liu, Y. (2023). Prompt Injection Attack Against LLM Integrated Applications. arXiv preprint.
9. Lodderstedt, T., McGloin, M., and Hunt, P. (2013). OAuth 2.0 Threat Model and Security Considerations. RFC 6819, Internet Engineering Task Force.
10. Perez, F., and Ribeiro, I. (2022). Ignore Previous Prompt: Attack Techniques for Language Models. arXiv preprint.
11. Rose, S., Borchert, O., Mitchell, S., and Connelly, S. (2020). Zero Trust Architecture. NIST Special Publication 800-207.
