Toward Understanding Security Issues in the Model Context Protocol Ecosystem
Xiaofan Li, Xing Gao
TL;DR
This work presents the first comprehensive security analysis of the Model Context Protocol (MCP) ecosystem, decomposing it into MCP hosts, registries, and servers and examining their interactions. Through large-scale data collection (67,057 servers) and targeted experiments, it reveals pervasive risks from unverified host outputs and unvetted registries, including tool confusion, context-dangling tools, tool poisoning, and affix-squatting. The study provides a set of practical defenses for hosts, registries, and users, and responsibly discloses findings to affected parties. The results highlight the need for verification, vetting, and custody controls to secure MCP deployments in real-world settings.
Abstract
The Model Context Protocol (MCP) is an emerging open standard that enables AI-powered applications to interact with external tools through structured metadata. A rapidly growing ecosystem has formed around MCP, including a wide range of MCP hosts (i.e., Cursor, Windsurf, Claude Desktop, and Cline), MCP registries (i.e., mcp.so, MCP Market, MCP Store, Pulse MCP, Smithery, and npm), and thousands of community-contributed MCP servers. Although the MCP ecosystem is gaining traction, there has been little systematic study of its architecture and associated security risks. In this paper, we present the first comprehensive security analysis of the MCP ecosystem. We decompose MCP ecosystem into three core components: hosts, registries, and servers, and study the interactions and trust relationships among them. Users search for servers on registries and configure them in the host, which translates LLM-generated output into external tool invocations provided by the servers and executes them. Our qualitative analysis reveals that hosts lack output verification mechanisms for LLM-generated outputs, enabling malicious servers to manipulate model behavior and induce a variety of security threats, including but not limited to sensitive data exfiltration. We uncover a wide range of vulnerabilities that enable attackers to hijack servers, due to the lack of a vetted server submission process in registries. To support our analysis, we collect and analyze a dataset of 67,057 servers from six public registries. Our quantitative analysis demonstrates that a substantial number of servers can be hijacked by attackers. Finally, we propose practical defense strategies for MCP hosts, registries, and users. We responsibly disclosed our findings to affected hosts and registries.