Source

arXiv:2601.17549 — Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents (Jan 2026)

Summary

First formal security analysis of MCP, identifying 3 architectural vulnerabilities with 23–41% higher attack success rates vs. non-MCP integrations. Proposes MCPSec, a backward-compatible extension cutting successful attacks from 52.8% to 12.4% with 8.3ms median overhead.

Vulnerabilities Affecting Zeph

1. Missing capability attestation — Zeph registers MCP tools without verifying server-claimed capabilities
2. Unauthenticated bidirectional sampling — rmcp supports bidirectional sampling without message authentication
3. Implicit multi-server trust propagation — multiple MCP servers are chained without trust isolation

MCPSec Proposals (Implementable)

• Capability attestation: schema addition to tool registration
• Message authentication: HMAC on rmcp transport layer (or TLS client certs)
• Per-server trust isolation: extending McpTrustLevel (PR feat(mcp): upgrade rmcp 1.2→1.3, add per-server trust level and tool allowlist #2213) with policy enforcement

Relation to Open Issues

Provides the threat model and protocol-level design for completing issue #2178 (MCP security hardening). Combined with PR #2213 (McpTrustLevel, tool_allowlist), this paper defines what's still missing.

Complexity

Medium — capability attestation is a schema addition; message auth requires rmcp transport-layer changes.