Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol

Huihao Jing, Haoran Li, Wenbin Hu, Qi Hu, Heli Xu, Tianshu Chu, Peizhao Hu, Yangqiu Song

TL;DR

This work tackles safety gaps in Model Context Protocol (MCP) by introducing MCIP, a safety-enhanced MCP guided by the MAESTRO framework. It identifies missing tracking and safety-aware components, and develops a Model Contextual Integrity Protocol with a tracking log format (MCI) and a safety guard (MCIP Guardian). A fine-grained taxonomy of MCP risks is paired with MCIP-bench and taxonomy-guided training data to evaluate and improve LLMs' risk recognition in MCP interactions. Experimental results across state-of-the-art models show notable improvements in safety metrics and a balanced safety–utility trade-off, offering a concrete blueprint for context-aware safety in multi-component LLM agent ecosystems.

Abstract

As Model Context Protocol (MCP) introduces an easy-to-use ecosystem for users and developers, it also brings underexplored safety risks. Its decentralized architecture, which separates clients and servers, poses unique challenges for systematic safety analysis. This paper proposes a novel framework to enhance MCP safety. Guided by the MAESTRO framework, we first analyze the missing safety mechanisms in MCP, and based on this analysis, we propose the Model Contextual Integrity Protocol (MCIP), a refined version of MCP that addresses these gaps. Next, we develop a fine-grained taxonomy that captures a diverse range of unsafe behaviors observed in MCP scenarios. Building on this taxonomy, we develop benchmark and training data that support the evaluation and improvement of LLMs' capabilities in identifying safety risks within MCP interactions. Leveraging the proposed benchmark and training data, we conduct extensive experiments on state-of-the-art LLMs. The results highlight LLMs' vulnerabilities in MCP interactions and demonstrate that our approach substantially improves their safety performance.

MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol

TL;DR

This work tackles safety gaps in Model Context Protocol (MCP) by introducing MCIP, a safety-enhanced MCP guided by the MAESTRO framework. It identifies missing tracking and safety-aware components, and develops a Model Contextual Integrity Protocol with a tracking log format (MCI) and a safety guard (MCIP Guardian). A fine-grained taxonomy of MCP risks is paired with MCIP-bench and taxonomy-guided training data to evaluate and improve LLMs' risk recognition in MCP interactions. Experimental results across state-of-the-art models show notable improvements in safety metrics and a balanced safety–utility trade-off, offering a concrete blueprint for context-aware safety in multi-component LLM agent ecosystems.

Abstract

As Model Context Protocol (MCP) introduces an easy-to-use ecosystem for users and developers, it also brings underexplored safety risks. Its decentralized architecture, which separates clients and servers, poses unique challenges for systematic safety analysis. This paper proposes a novel framework to enhance MCP safety. Guided by the MAESTRO framework, we first analyze the missing safety mechanisms in MCP, and based on this analysis, we propose the Model Contextual Integrity Protocol (MCIP), a refined version of MCP that addresses these gaps. Next, we develop a fine-grained taxonomy that captures a diverse range of unsafe behaviors observed in MCP scenarios. Building on this taxonomy, we develop benchmark and training data that support the evaluation and improvement of LLMs' capabilities in identifying safety risks within MCP interactions. Leveraging the proposed benchmark and training data, we conduct extensive experiments on state-of-the-art LLMs. The results highlight LLMs' vulnerabilities in MCP interactions and demonstrate that our approach substantially improves their safety performance.

Paper Structure

This paper contains 53 sections, 8 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. LLM Tool Use
  4. Agentic AI Threat Modeling Framework
  5. Contextual Integrity
  6. MCIP
  7. Tracking Log Format
  8. MCI Definition
  9. MCIP Guardian
  10. Under MCIP: Taxonomy
  11. Threat Phase
  12. Config and Termination Phase:
  13. Client–Server Interaction Phase:
  14. Threat Source, Threat Type
  15. Threat Scope
  16. ...and 38 more sections

Figures (8)

  • Figure 1: Overview of MCP structure
  • Figure 2: MAESTRO’s 7-layer reference architecture for agentic AI.
  • Figure 3: Taxonomy of safety risks for MCP. The leftmost column of the table shows the phase in which each risk occurs. The main body categorizes risks by their source, scope, type, and corresponding MAESTRO layers.
  • Figure 4: Overview of data distribution in MCIP-bench
  • Figure 5: Safety-Utility Trade-off: General vs. Function Calling Models vs. MCIP Guardian.
  • ...and 3 more figures