ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control

R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public-key cryptosystems,” Communications of the ACM , vol. 21, no. 2, pp. 120–126, 1978

1978

Earlier work this paper cites.

D. Hardt, “The oauth 2.0 authorization framework,” RFC 6749, 2012. [Online]. Available: https://datatracker.ietf.org/doc/html/rfc6749

2012

Earlier work this paper cites.

A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner, “Android Permissions: User Attention, Comprehension, and Behavior,” in Proceedings of the Eighth ACM Symposium on Usable Privacy and Security (SOUPS ’12) . ACM, 2012, pp. 3:1–3:14, also available as UC Berkeley EECS Technical Report EECS-2012-26

2012

Earlier work this paper cites.

J. Katz and Y. Lindell, Introduction to Modern Cryptography . Chapman and Hall/CRC, 2014

2014

Earlier work this paper cites.

M. Jones, J. Bradley, and N. Sakimura, “Json web token (jwt),” RFC 7519, 2015. [Online]. Available: https://datatracker.ietf.org/doc/html/rfc7519

2015

Earlier work this paper cites.

M. Jones, “Json web signature (jws),” RFC 7515, 2015. [Online]. Available: https://tools.ietf.org/html/rfc7515

2015

Earlier work this paper cites.

D. Fett, R. Kuesters, and G. Schmitz, “A comprehensive formal security analysis of oauth 2.0,” Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pp. 1204–1215, 2016. [Online]. Available: https://publ.sec.uni-stuttgart.de/fettkuestersschmitz-ccs-2016.pdf

2016

Earlier work this paper cites.

S. Torres-Arias and et al., “A new tool wants to save open source from supply chain attacks,” WIRED , 2021. [Online]. Available: https://www.wired.com/story/sigstore-open-source-supply-chain-code-signing/

2021

Cited alongside, same era.

C. Allen, “Decentralized identifiers (dids) v1.0,” 2021. [Online]. Available: https://www.w3.org/TR/did-core/

2021

Cited alongside, same era.

Oso Team, “Best Practices for Authorization in Microservices,” Oso Blog , 2023, available: https://www.osohq.com/post/microservices-authorization-patterns

2023

Cited alongside, same era.

ReversingLabs Team, “MCP is a powerful new AI coding technology: Understand the risks,” ReversingLabs Blog , 2024, available: https://www.reversinglabs.com/blog/mcp-powerful-ai-coding-risk

2024

Cited alongside, same era.

D. Sarig, A. Maoz, Y. FOGEL, I. Harel, and B. Jimmy, “Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework for Generative AI Agents,” arXiv preprint arXiv:2405.03221 , May 2024, available: https://www.researchgate.net/publication/391247531_Securing_Agentic_AI_A_Comprehensive_Threat_Model_and_Mitigation_Framework_for_Generative_AI_Agents

Model Context Protocol Working Group, “Model Context Protocol Specification,” [Online], Mar. 2025, version 2025-03-26. Available: https://modelcontextprotocol.io/specification/2025-03-26/

2025

Closest in time.

S. Willison, “Model Context Protocol has prompt injection security problems,” Simon Willison’s Weblog , Apr. 2024, https://simonwillison.net/2025/Apr/9/mcp-prompt-injection

2025

Closest in time.

V. S. Narajala, K. Huang, and I. Habler, “Securing genai multi-agent systems against tool squatting: A zero trust registry-based approach,” arXiv preprint arXiv:2504.19951 , 2025. [Online]. Available: https://arxiv.org/abs/2504.19951

Original

2025

Closest in time.

A. Narayanan and et al., “Persistent attacks on large language models beyond user injection,” arXiv preprint arXiv:2505.06493 , 2025. [Online]. Available: https://arxiv.org/abs/2505.06493

Original

2025

Closest in time.