Mind Your Server: A Systematic Study of Parasitic Toolchain Attacks on the MCP Ecosystem

TL;DR

The paper shows that the Model Context Protocol (MCP) enables LLMs to autonomously orchestrate multi-tool workflows, creating new security hazards captured by MCP-Unintended Privacy Disclosure (MCP-UPD). It formalizes a three-phase parasitic toolchain (Parasitic Ingestion, Privacy Collection, Privacy Disclosure) and identifies root causes in missing context-tool isolation and weak least-privilege enforcement. Through MCP-Sec, a large-scale census across 1,360 MCP servers and 12,230 tools, it reveals 8.7% of tools and 27.2% of servers expose exploitable capabilities, and that complete toolchains can operate in real-world settings. The work proposes defense mechanisms—context-tool isolation, privilege minimization, and cross-tool auditing—and discusses extensions to other parasitic attacks, underscoring urgent practical implications for securing MCP-based ecosystems.

Abstract

Large language models (LLMs) are increasingly integrated with external systems through the Model Context Protocol (MCP), which standardizes tool invocation and has rapidly become a backbone for LLM-powered applications. While this paradigm enhances functionality, it also introduces a fundamental security shift: LLMs transition from passive information processors to autonomous orchestrators of task-oriented toolchains, expanding the attack surface, elevating adversarial goals from manipulating single outputs to hijacking entire execution flows. In this paper, we reveal a new class of attacks, Parasitic Toolchain Attacks, instantiated as MCP Unintended Privacy Disclosure (MCP-UPD). These attacks require no direct victim interaction; instead, adversaries embed malicious instructions into external data sources that LLMs access during legitimate tasks. The malicious logic infiltrates the toolchain and unfolds in three phases: Parasitic Ingestion, Privacy Collection, and Privacy Disclosure, culminating in stealthy exfiltration of private data. Our root cause analysis reveals that MCP lacks both context-tool isolation and least-privilege enforcement, enabling adversarial instructions to propagate unchecked into sensitive tool invocations. To assess the severity, we design MCP-SEC and conduct the first large-scale security census of the MCP ecosystem, analyzing 12,230 tools across 1,360 servers. Our findings show that the MCP ecosystem is rife with exploitable gadgets and diverse attack methods, underscoring systemic risks in MCP platforms and the urgent need for defense mechanisms in LLM-integrated environments.

Figures (5)

• Figure 1: Overview of the MCP workflow architecture. The diagram illustrates the seven-step process: ➀ Initializing connections between MCP Host and Servers, ➁ Prompt Formatting of user requests, ➂ Decision making by the Large Language Model, ➃ Tool Invoking through MCP clients, ➄ Tool Executing on MCP servers, ➅ Result organizing by the LLM, and ➆ Result Presenting to the user. The architecture shows the MCP Host managing multiple MCP clients that connect to corresponding MCP servers, each equipped with various tools (tool1, tool2, tool3). The LLM (represented by logos of different language models) serves as the central decision-making component that processes user prompts, determines tool invocations, and organizes results before final presentation.
• Figure 2: Attack process of MCP-UPD (MCP Unauthorized Privacy Disclosure). The diagram illustrates a three-phase parasitic toolchain attack: ➀ Parasitic Ingestion: the user invokes an external ingestion tool (get_posts) to retrieve content containing a malicious prompt that instructs the agent to perform unauthorized actions; ➁ Privacy Collection: the compromised agent follows the injected instructions to access sensitive local files (mcp.json) using privacy access tools (read_file); ➂ Privacy Disclosure: the agent exfiltrates the collected privacy data to the attacker-controlled endpoint (diag@attacker.com) through network access tools (send_mail).
• Figure 3: The workflow of MCP-Sec.
• Figure 4: Statistics of exploitable MCP tools/servers. EIT/S represents the External Ingestion Tool/Server, PAT/S represents the Privacy Access Tool/Server, NAT/S represents the Network Access Tool/Server.
• Figure 5: Distribution of GitHub stars of MCP servers with risky tools.