AegisMCP: Online Graph Intrusion Detection for Tool-Augmented LLMs on Edge Devices

TL;DR

AegisMCP tackles the security gap created by MCP-driven LLM agents in smart homes by reframing agent-tool orchestration as a streaming heterogeneous temporal graph. The authors introduce NEBULA-Schema to capture protocol-level activity (install, invoke, net_out) and design a CPU-efficient GraphSAGE-based detector that fuses edge behavior, session-DAG structure, and novelty signals for near-real-time inference on edge hardware. Their evaluation on emulated and physical testbeds shows sub-second per-window latency with high detection performance (AUROC ≈ 0.985, AP ≈ 0.947) and favorable energy profiles, outperforming traditional traffic-only baselines and certain graph baselines. The work demonstrates that protocol-aware, structure-driven monitoring can robustly detect zero-day misuse of sanctioned MCP capabilities, providing a practical, privacy-conscious defense for home environments, with open-source artifacts to support reproducibility and extension.

Abstract

In this work, we study security of Model Context Protocol (MCP) agent toolchains and their applications in smart homes. We introduce AegisMCP, a protocol-level intrusion detector. Our contributions are: (i) a minimal attack suite spanning instruction-driven escalation, chain-of-tool exfiltration, malicious MCP server registration, and persistence; (ii) NEBULA-Schema (Network-Edge Behavioral Learning for Untrusted LLM Agents), a reusable protocol-level instrumentation that represents MCP activity as a streaming heterogeneous temporal graph over agents, MCP servers, tools, devices, remotes, and sessions; and (iii) a CPU-only streaming detector that fuses novelty, session-DAG structure, and attribute cues for near-real-time edge inference, with optional fusion of local prompt-guardrail signals. On an emulated smart-home testbed spanning multiple MCP stacks and a physical bench, AegisMCP achieves sub-second per-window model inference and end-to-end alerting. The latency of AegisMCP is consistently sub-second on Intel N150-class edge hardware, while outperforming traffic-only and sequence baselines; ablations confirm the importance of DAG and install/permission signals. We release code, schemas, and generators for reproducible evaluation.

Figures (9)

• Figure 1: AegisMCP overview: protocol‑level instrumentation, streaming graph construction, and CPU‑only fused detection at the edge.
• Figure 2: Protocol-aware pipeline (NEBULA $\rightarrow$ Graph $\rightarrow$ Fusion). The collector converts the NEBULA event stream (MCP install, invoke, and net_out with attributes {ts, bytes, port, status}) into (i) a 10 s windowed heterogeneous graph and (ii) a session DAG. The structured graph model (GraphSAGE in our deployment) produces per-edge behavior scores (edge_score); in parallel, the DAG analyzer computes sequence features (chain length, branch/rare-path, install proximity) and yields a dag_score. A tri-signal fusion stage combines behavior, DAG, and novelty/attribute heuristics and applies FPR-cap thresholds (observe/high) to write alerts (alerts_fused.parquet). No payload/DPI is used; only protocol-level semantics and minimal network metadata.
• Figure 3: Smart-home testbed on Intel N150. The box hosts Dockerized Home Assistant and Mosquitto alongside the NEBULA collector/builder/detector and power/latency instrumentation. MQTT drives emulated device domains (Lighting/Ambience, Comfort/Climate, Appliance/Energy, Voice/Media), while the Security domain contains the physical Reolink PoE camera/siren used in Day 13 trials. Arrows indicate MQTT flows; the LAN/switch provides the observation point for minimal network metadata (5-tuple/SNI). Labeled edges mark the scenarios exercised in evaluation: night unlock, silent camera, alarm suppression, and leak response. Session-DAG changes are captured as the agent orchestrates devices/tools during each scenario.
• Figure 4: Ablation on the test split. Bars show Average Precision (left axis); the line with markers shows session-level Recall at FPR$\le$2% (right axis). Thresholds for recall are selected on validation to cap FPR at 2% and then applied to test. Methods include traffic-only and sequence baselines, a rules-only filter, graph backbones (GCN, R-GCN), and our behavior detector in Full form as well as an edge-oriented Lite profile; Fused2 combines behavior with a prompt guardrail score (0.8/0.2 on validation). This snapshot illustrates that structure-aware behavior models sustain higher recall at a fixed low FPR than text-only or prompt-only signals, while AP reflects overall ranking quality across the stream.
• Figure 5: Inference resource profiles on Intel N150 (Alder Lake-N). RAPL package power and system CPU sampled during identical inference runs. These traces illustrate that structure-aware behavior profiles (Full/Lite) meet edge budgets with small power variance, whereas sequence models are CPU-unfriendly on this platform.