Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Securing AI Agent Execution

Christoph Bühler, Matteo Biagiola, Luca Di Grazia, Guido Salvaneschi

TL;DR

This work tackles the security gaps in Model Context Protocol (MCP) ecosystems by introducing AgentBound, a framework that enforces least-privilege execution for AI agents. It combines a declarative policy language (AgentManifest) with a runtime policy-enforcement engine (AgentBox) that containers MCP servers to prevent unauthorized access, all without modifying existing servers. The authors demonstrate high completeness of the manifest vocabulary (approximately 80.9% accuracy in automatic generation and 96.5% in manual validation) across 296 MCP servers, and show that the enforcement incurs negligible runtime overhead (around 0.3–0.6 ms per operation) while blocking a wide range of environment-targeted attacks. They also reveal some limitations, notably puppet and certain prompt-injection-style threats, suggesting directions for integrating AgentBound with complementary scanners and anomaly-detection tools. Overall, AgentBound provides a practical, near-zero-overhead security boundary for MCP-based AI agent deployments, enabling safer exploration of the MCP ecosystem at scale.

Abstract

Large Language Models (LLMs) have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol (MCP) has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers execute with unrestricted access to host systems, creating a broad attack surface. In this paper, we introduce AgentBound, the first access control framework for MCP servers. AgentBound combines a declarative policy mechanism, inspired by the Android permission model, with a policy enforcement engine that contains malicious behavior without requiring MCP server modifications. We build a dataset containing the 296 most popular MCP servers, and show that access control policies can be generated automatically from source code with 80.9% accuracy. We also show that AgentBound blocks the majority of security threats in several malicious MCP servers, and that policy enforcement engine introduces negligible overhead. Our contributions provide developers and project managers with a practical foundation for securing MCP servers while maintaining productivity, enabling researchers and tool builders to explore new directions for declarative access control and MCP security.

Securing AI Agent Execution

TL;DR

This work tackles the security gaps in Model Context Protocol (MCP) ecosystems by introducing AgentBound, a framework that enforces least-privilege execution for AI agents. It combines a declarative policy language (AgentManifest) with a runtime policy-enforcement engine (AgentBox) that containers MCP servers to prevent unauthorized access, all without modifying existing servers. The authors demonstrate high completeness of the manifest vocabulary (approximately 80.9% accuracy in automatic generation and 96.5% in manual validation) across 296 MCP servers, and show that the enforcement incurs negligible runtime overhead (around 0.3–0.6 ms per operation) while blocking a wide range of environment-targeted attacks. They also reveal some limitations, notably puppet and certain prompt-injection-style threats, suggesting directions for integrating AgentBound with complementary scanners and anomaly-detection tools. Overall, AgentBound provides a practical, near-zero-overhead security boundary for MCP-based AI agent deployments, enabling safer exploration of the MCP ecosystem at scale.

Abstract

Large Language Models (LLMs) have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol (MCP) has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers execute with unrestricted access to host systems, creating a broad attack surface. In this paper, we introduce AgentBound, the first access control framework for MCP servers. AgentBound combines a declarative policy mechanism, inspired by the Android permission model, with a policy enforcement engine that contains malicious behavior without requiring MCP server modifications. We build a dataset containing the 296 most popular MCP servers, and show that access control policies can be generated automatically from source code with 80.9% accuracy. We also show that AgentBound blocks the majority of security threats in several malicious MCP servers, and that policy enforcement engine introduces negligible overhead. Our contributions provide developers and project managers with a practical foundation for securing MCP servers while maintaining productivity, enabling researchers and tool builders to explore new directions for declarative access control and MCP security.
Paper Structure (36 sections, 6 figures, 1 table)

This paper contains 36 sections, 6 figures, 1 table.

Table of Contents

  1. Introduction
  2. Background in AI Agents, MCP, and their Security
  3. AI Agents
  4. Model Context Protocol (MCP)
  5. MCP Threat Model
  6. Executive Summary
  7. The AgentBound AI Agent Security Framework
  8. Access Control Policy
  9. Manifests
  10. Automated Manifest Generation
  11. Policy Enforcement Engine
  12. Implementation
  13. Automated manifest generation
  14. Policy enforcement engine
  15. Empirical Evaluation
  16. ...and 21 more sections

Figures (6)

  • Figure 1: Interaction between user, agent, LLM, and two MCP servers.
  • Figure 2: Overview of AgentBound. Users interact with the AI agent, which interacts---through the policy enforcement engine (AgentBox)---with MCP servers communicating with the environment. The policy enforcement engine ensures an MCP server can only access the resources allowed by the access control policy (AgentManifest).
  • Figure 3: Distribution of Top-5 Access Control Policy permissions across 296 MCP servers.
  • Figure 4: Distribution of Top-5 Android manifest permissions across 296 MCP servers.
  • Figure 5: Counts per attack type, excluding generic attacks, split into preventable and non-preventable.
  • ...and 1 more figures