Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem

Snowball Sampling

Leo A. Goodman · 1961

Earlier work this paper cites.

Ethereum: A secure decentralised generalised transaction ledger

Gavin Wood et al · 2014

Earlier work this paper cites.

Quantifying developers’ adoption of security tools

Jim Witschey, Olga Zielinska, Allaire Welk, Emerson Murphy-Hill, Chris Mayhorn, and Thomas Zimmermann · 2015

Earlier work this paper cites.

An Overview of Blockchain Technology: Architecture, Consensus, and Future Trends

Zibin Zheng, Shaoan Xie, Hongning Dai, Xiangping Chen, and Huaimin Wang · 2017

Earlier work this paper cites.

Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages

Ruian Duan, Omar Alrawi, Ranjita Pai Kasturi, Ryan Elder, Brendan Saltaformaggio, and Wenke Lee · 2021

Earlier work this paper cites.

Smart Contract Security: A Practitioners’ Perspective

Zhiyuan Wan, Xin Xia, David Lo, Jiachi Chen, Xiapu Luo, and Xiaohu Yang · 2021

Earlier work this paper cites.

One step further: evaluating interpreters using metamorphic testing

Ming Fan, Jiali Wei, Wuxia Jin, Zhou Xu, Wenying Wei, and Ting Liu · 2022

Earlier work this paper cites.

Explanation-guided fairness testing through genetic algorithm

Ming Fan, Wenying Wei, Wuxia Jin, Zijiang Yang, and Ting Liu · 2022

Earlier work this paper cites.

Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz · 2023

Earlier work this paper cites.

API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMs

Minghao Li, Yingxiu Zhao, Bowen Yu, Feifan Song, Hangyu Li, Haiyang Yu, Zhoujun Li, Fei Huang, and Yongbin Li · 2023

Earlier work this paper cites.

Securing large language models: Threats, vulnerabilities and responsible practices, 2024

Original

Sara Abdali, Richard Anarfi, CJ Barberan, and Jia He · 2024

Earlier work this paper cites.

A Survey on Evaluation of Large Language Models

Yupeng Chang, Xu Wang, Jindong Wang, et al · 2024

Earlier work this paper cites.

RMCBench: Benchmarking Large Language Models’ Resistance to Malicious Code

Jiachi Chen, Qingyuan Zhong, Yanlin Wang, Kaiwen Ning, Yongkun Liu, Zenan Xu, Zhe Zhao, Ting Chen, and Zibin Zheng · 2024

Earlier work this paper cites.

Chatbot arena: An open platform for evaluating LLMs by human preference

Wei-Lin Chiang, Lianmin Zheng, Ying Sheng, Anastasios N. Angelopoulos, Tianle Li, Dacheng Li, Banghua Zhu, Hao Zhang, Michael I. Jordan, Joseph E. Gonzalez, and Ion Stoica · 2024

Earlier work this paper cites.

Deepseek-v3 technical report, 2024

Original

DeepSeek-AI · 2024

Earlier work this paper cites.

The llama 3 herd of models, 2024

Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, et al · 2024

Earlier work this paper cites.

Prompt injection attack against llm-integrated applications, 2024

Original

Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu · 2024

Earlier work this paper cites.

Cheatagent: Attacking llm-empowered recommender systems via llm agent

Liang-bo Ning, Shijie Wang, Wenqi Fan, Qing Li, Xin Xu, Hao Chen, and Feiran Huang · 2024

Earlier work this paper cites.

GPT-4o, 2024

OpenAI · 2024

Earlier work this paper cites.

Optimization-based prompt injection attack to llm-as-a-judge

Jiawen Shi, Zenghui Yuan, Yinuo Liu, Yue Huang, Pan Zhou, Lichao Sun, and Neil Zhenqiang Gong · 2024

Earlier work this paper cites.

Bdmmt: Backdoor sample detection for language models through model mutation testing

Jiali Wei, Ming Fan, Wenjing Jiao, Wuxia Jin, and Ting Liu · 2024

Earlier work this paper cites.

Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents

Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei Wang, and Yongfeng Zhang · 2024

Cited alongside, same era.

Imperceptible content poisoning in llm-powered applications

Quan Zhang, Chijin Zhou, Gwihwan Go, Binqi Zeng, Heyuan Shi, Zichen Xu, and Yu Jiang · 2024

Cited alongside, same era.

Privacyasst: Safeguarding user privacy in tool-using large language model agents

Xinyu Zhang, Huiyu Xu, Zhongjie Ba, Zhibo Wang, Yuan Hong, Jian Liu, Zhan Qin, and Kui Ren · 2024

Cited alongside, same era.

Attacks on Third-Party APIs of Large Language Models

Wanru Zhao, Vidit Khazanchi, Haodi Xing, Xuanli He, Qiongkai Xu, and Nicholas Donald Lane · 2024

Cited alongside, same era.

Claude 3.7 Sonnet, 2025

Anthropic · 2025

Cited alongside, same era.

Claude desktop, 2025

Anthropic · 2025

Gemini 2.5 Pro, 2025

Google · 2025

Closest in time.

Mcp client, how to write system prompt for mcp call tools, 2025

Guolisen · 2025

Closest in time.

Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers, 2025

Mohammed Mehedi Hasan, Hao Li, Emad Fallahzadeh, Gopi Krishnan Rajbahadur, Bram Adams, and Ahmed E. Hassan · 2025

Closest in time.

Model context protocol (mcp): Landscape, security threats, and future research directions, 2025

Original

Xinyi Hou, Yanjie Zhao, Shenao Wang, and Haoyu Wang · 2025

Closest in time.

G-search-mcp, 2025

Jaeger · 2025

Closest in time.

Protocol for system prompts, 2025

Ktalebian · 2025

Closest in time.