Hugging Face model: shiqiangchen6/mcp-security-taxonomy
Author: shiqiangchen6
Created: 2026-07-15 06:12:12
Last modified: 2026-07-15 06:38:32
Likes: 0 | Downloads: 0
Tags: mcp-security, ai-agent-security, model-context-protocol, vulnerability-taxonomy, tool-security, license:apache-2.0, region:us
Card metadata:
title: An Empirical Study of MCP Server Security: 6 Attack Surfaces from 30+ Audits
authors: name: Shiqiang Chen
affiliation: Independent Researcher
abstract: The Model Context Protocol (MCP) is rapidly becoming a cornerstone of AI agent interoperability, yet its security implications remain largely unexplored. This paper presents the first systematic empirical study of MCP server security, analyzing over 30 publicly available implementations. We identify six distinct attack surfaces: Tool Parameter Injection, Inspector Exposure, Client Trust Exploitation, Transport Security weaknesses, Implementation Flaws, and Supply Chain vulnerabilities. Through manual code audits and dynamic testing, we discovered 2 previously unknown CVEs and catalogued dozens of security-relevant patterns. Our taxonomy provides a structured framework for understanding MCP-specific threats, and we propose concrete defensive measures at the protocol, implementation, and operational levels.

tags: mcp-security, ai-agent-security, model-context-protocol, vulnerability-taxonomy, tool-security
license: apache-2.0