---
title: 'MCPLIB: MCP Attack Library'
url: https://www.emergentmind.com/topics/mcp-attack-library-mcplib
type: topic
---

# MCPLIB: MCP Attack Library

The MCP Attack Library (MCPLIB) is a unified, extensible framework that catalogs, implements, and systematizes attacks targeting the Model Context Protocol (MCP)—the standard for LLM-based agentic tool integration. It provides formal taxonomies, attack modules, quantitative evaluation harnesses, and analytic workflows for assessing the security posture of MCP-based AI agents, tools, servers, and cross-ecosystem deployments [2508.12538][2509.06572][2511.20920][2510.15994][2603.10163][2602.14281].

## 1. Taxonomy of Attack Classes and Methods

MCPLIB introduces a comprehensive, empirically validated taxonomy of attacks, systematically categorizing over 30 distinct methods across four or more fundamental threat classes [2508.12538]:

1. **Direct Tool Injection Attacks**: Adversaries directly embed payloads in tool code, docstrings, or metadata. This includes single-tool and multi-tool vectors:
   - File-based addition (`__doc__` manipulating `mcp.json` or `.bashrc`)
   - File deletion/modification/retrieval, RCE, listener attachment
   - Rug-pull via post-deployment updates
   - Multi-tool cooperation, shadowing, preference manipulation

2. **Indirect Tool Injection Attacks**: Malicious content delivered via dependencies, data sources, or return flows rather than direct tool modification.
   - Webpage/data poisoning, package README-driven RCE
   - Malicious tool return output injection (e.g., "call admin_tool" error chains)

3. **Malicious User Attacks**: Privileged users damage the ecosystem from within, leveraging registration, privilege escalation, data injection (e.g., CSV exploits), installer spoofing, or sandbox escape.

4. **LLM Inherent Attacks**: Classical LLM weaknesses (jailbreaks, prompt leakage, hallucination, goal hijack) become more severe when tool invocation is permitted. Examples include embedding DAN-style jailbreaks in tool docs or using hallucinated tools for data exfiltration.

5. **Cross-System and Supply Chain Attacks**: Compromised dependencies, server registry confusion, version rug-pulls, and privilege escalation via over-permissioning are cataloged as independent categories [2511.20920].

6. **Parasitic Toolchain and Context Poisoning Attacks**: Parasitic ingestion of prompts from external data sources, culminating in privacy collection and network exfiltration, as well as toolchain-wide propagation of adversarial instructions [2509.06572].

The following table organizes these as implemented/defined in MCPLIB:

| Major Class                      | Subclasses/Examples                                                            | Key MCPLIB Instantiations                  |
|-----------------------------------|-------------------------------------------------------------------------------|-------------------------------------------|
| Direct tool injection             | File add/del/mod, RCE, docshadow, rug-pull, forced execution                  | Methods 1–15 [2508.12538]                 |
| Indirect tool injection           | Webpage poison, output injection, project install RCE                         | Methods 16–18 [2508.12538], MCP-UPD [2509.06572] |
| Malicious user                    | Tool registration, data uploads, privilege escalation, token theft            | Methods 19–25                             |
| LLM inherent                      | Jailbreak, prompt leak, hallucination, goal hijack, SQL/API exfil             | Methods 26–31                             |
| Supply chain / ecosystem          | Registry confusion, rugpull, arbitrary code exec, over-permissioning          | [2511.20920]                              |
| Parasitic toolchain attacks       | Stepwise privacy exfiltration, file writes, remote command exec               | MCP-UPD, MCP-AFW, MCP-RCE [2509.06572]    |

## 2. MCPLIB Framework Architecture and Implementation

MCPLIB is a modular, Python-based plugin system with support for dynamic attack enumeration, benchmarking, and exploit automation. Its core architecture is composed of four primary modules [2508.12538][2510.15994][2603.10163]:

- **Plugin Loader**: Discovers and loads attack plugins, each implementing standardized APIs (name, description, activate).
- **Attacker Resource Layer**: Hosts supporting gadgets for indirect injections (malicious web/data/SQL/Git targets).
- **Prompt Template Engine**: Syncretizes prompt-level, data-level, and tool-level payloads for user/LLM-exploitable vectors.
- **Orchestrator**: Manages attack lifecycles, tool registrations, agent simulation, and log collection for evaluative runs.

Advanced static analysis and compliance-checking capabilities are provided by MCPLIB’s IR/AST-driven pipelines [2603.10163]. Language-agnostic clause-compliance is established by normalizing SDKs across ten languages and applying both static and LLM-guided reasoning to detect missing guardrails, which are then correlated to three formal exploit modalities: joint payload/timing control, payload-only, and timing-only control.

## 3. Formal Metrics and Evaluation Methodologies

MCPLIB operationalizes several formal efficacy and robustness metrics for attack and defense benchmarking:

- **Attack Efficacy ($E$)**: A weighted sum of success rate ($S$), security risk level ($L$), persistence ($I$), and implementation difficulty ($D$), with entropy-based normalization:
  $$
  E = w_1 S + w_2 L + w_3 I + w_4 D
  $$
  where $w_j$ are entropy-derived weights; $S$ is observed over 10 runs; $L$ is the Narajala 7-point security risk; $I$ (1–2, immediate or persistent); $D$ (1=easiest to 3=complex) [2508.12538].

- **Net Resilient Performance (NRP)**: Quantifies the security–utility trade-off for LLM agents. Given the Attack Success Rate (ASR) and Performance Under Attack (PUA):
  $$
  \mathrm{NRP} = \mathrm{PUA} \cdot (1 - \mathrm{ASR})
  $$
  High NRP indicates robust task completion with low vulnerability; low NRP signals effective adversarial disruption [2510.15994].

Experimental harnesses systematically instantiate agents (e.g., Meta Claude, Anthropic Claude-2, OpenAI function-calling wrappers), register both benign and malicious tools via a local server, and run attack scenarios with fine-grained sensitivity analyses (user confirmation, tool schema, LLM temperature) [2508.12538][2510.15994].

## 4. Empirical Findings From Systematic MCPLIB Experiments

Large-scale evaluation demonstrates that:

- **File-based tool injection, preference-manipulation, and malicious tool coverage obtain nearly 100% attack success with high severity (E≈8.4)**.
- **Indirect tool output and data-return attacks** (e.g., parasitic toolchain, context contamination) regularly achieve ASR >80–90% due to agents’ default trust in tool outputs.
- **Multi-tool cooperation and infectious template attacks display lower immediate S (30–70%) but high security risk ($L=7$) and persistent system compromise.
- **Supply chain attacks (rug-pull, registry confusion) and dynamically delayed-onset attacks (behavioral drift)** bypass one-time defenses and exploit configuration/governance failures [2511.20920][2602.14281].
- **Empirically identified core vulnerabilities** include:
  - Unvetted file-system and process effects (no consent for add/modify/retrieve).
  - Blind reliance on tool descriptions for selection and invocation.
  - Context-sharing leading to chain/infectious attacks across sessions and tool generations.
  - Lack of accurate data/instruction separation.

## 5. Root-Cause Analyses and Modalities of Exploitation

MCPLIB incorporates fine-grained root-cause analyses employing formal definitions of context–tool isolation and privilege enforcement (or the lack thereof):

- **Absence of Context–Tool Isolation**: MCP tool outputs are ingested alongside trusted context without sanitization, making adversarial prompts indistinguishable from legitimate instructions [2509.06572].
- **Omission of Least-Privilege**: All tools operate under uniform trust, with no scope restriction or explicit consent for sensitive actions.
- **Exploit Modality Classification** (Editor’s term): For each missing clause, MCPLIB classifies whether its absence enables joint payload/timing control, payload-only, or timing-only attacks, using binary guardrail indicators $G_p, G_t$ [2603.10163].
- **Ecosystem Prevalence**: MCP-SEC census reveals 46.4% of MCP tools expose threat capabilities (external ingestion, privacy access, network egress), and 78.5% of servers host at least one such tool [2509.06572].

## 6. Defensive Strategies and Design Recommendations

Empirical results and formal analyses yield a layered set of best-practice mitigations:

- **Principle of Least Privilege**: All file/network/process operations require explicit user confirmation and path whitelisting. Fine-grained capability labeling and per-tool sandbox or chroot isolation are recommended [2508.12538][2509.06572].
- **Metadata Vetting and Schema Validation**: Automatic scanning of tool metadata (__doc__, description, return schema) to remove shell commands, suspicious instructions, or untrusted parameter fields.
- **Context Segmentation and Zero-Trust Chaining**: Partition shared agent context per session or tool, requiring explicit re-authorization to carry forward any variables or snippets.
- **Data/Instruction Channel Separation**: Tag all tool returns as data, enforce pattern-based rejection of latent command markers.
- **Runtime Monitoring and Auditing**: Centralized logging of all tool calls, with ReAct-style secondary agent auditing, detection of anomalous call chains (e.g., EIT→PAT→NAT), and automated pausing for suspicious workflows [2510.15994][2511.20920].
- **Governance and Supply Chain Hardening**: Pin dependencies, restrict tool/server registry to vetted/private sources, and block local server execution where sandboxing is not possible [2511.20920].
- **Periodic Robustness Audits with MCPLIB**: Routine red-teaming of agents with MCPLIB’s attack suite; regression checks on NRP and ASR metrics after each code or agent model update [2510.15994][2603.10163].

## 7. Role and Impact in the MCP Ecosystem

MCPLIB has become the reference toolkit for MCP-specific adversarial testing and CI integration, used for conformance testing, SDK static analysis, and agent evaluation [2603.10163]. It is fully compatible with multi-language SDK audits, and its attack modules are extensible for custom zero-day analysis. Its deployment has led to >20 high-priority vulnerability disclosures and has directly shaped security guidelines and governance recommendations in MCP protocol development workflows [2603.10163][2508.12538].

This foundational position is reinforced by its dual role as both a dynamic attack-benchmarking harness and a static compliance/conformance analyzer, providing the only open-source end-to-end solution for systematic MCP security assessment to date.

---

*References*:
- [2508.12538]: Systematic Analysis of MCP Security
- [2509.06572]: Mind Your Server: A Systematic Study of Parasitic Toolchain Attacks on the MCP Ecosystem
- [2511.20920]: Securing the Model Context Protocol (MCP): Risks, Controls, and Governance
- [2510.15994]: MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
- [2603.10163]: Compatibility at a Cost: Systematic Discovery and Exploitation of MCP Clause-Compliance Vulnerabilities
- [2602.14281]: MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents

Source: https://www.emergentmind.com/topics/mcp-attack-library-mcplib