MCP Executor: Protocol-Driven Vision Workflows

• MCP Executor is an orchestration engine that manages schema-bound invocation of vision tools in dynamic, multi-step workflows.
• It integrates typed JSON schemas, context object management, and runtime validators to ensure compositional fidelity and secure execution.
• Audit studies reveal systemic weaknesses including schema divergence, missing runtime validations, and security risks such as code injection.

A Model Context Protocol (MCP) Executor is the agent-driven orchestration engine at the core of MCP-based computer vision (CV) systems. It manages the schema-bound invocation and coordination of external vision tools, ensuring modularity and composability across dynamic, multi-step workflows. Within vision-centric agentic systems, the MCP Executor’s primary function is to bridge formal, typed tool schemas with persistent, protocol-governed execution context, thereby enabling agents to dynamically compose, sequence, and audit workflows without retraining or static pipeline reconfiguration.

1. Schema-Bound Execution Model

MCP Executor operation hinges on a formal schema-bound execution model:

• Tool Interface Specification: Each vision tool exposes its interface as a typed JSON schema, detailing the expected inputs/outputs, precise formats (e.g., array shape, encoding), constraints, and operational modalities.
• Context Object Management: The Executor maintains and updates context objects—persistent, hierarchical memory stores that encapsulate intermediate state, history, and outputs across all stages of a workflow.
• Decoupled Orchestration: Unlike inline prompting (LLM) or static code chains, reasoning (agentic planning) is separated from execution. The agent queries schemas at runtime, selects eligible tools (using eligibility/fallback/preference policies), and instructs the Executor to invoke them with contextually appropriate arguments.
• Dynamic Composability: The Executor supports runtime addition/removal of tools, schema-based fallback handling, and flexible adaptation to tool failures or workflow changes, all without requiring agent retraining.

2. Compositional Fidelity: Nine Audit Dimensions

Compositional reliability and interoperability depend on nine core dimensions of fidelity, all scrutinized within the MCP Executor by a recent large-scale audit of 91 vision-centric servers:

1. Schema format alignment: Structural/semantic congruence of input and output schemas across tools.
2. Coordinate convention declaration: Explicitness in spatial reference schemes (e.g., pixel vs. normalized; bounding box coordinate order).
3. Mask–image dimensional consistency: Shape/channel compatibility between predicted masks and source images.
4. Memory scoping/documentation: Transparent, versioned handling of persistent workflow state and memory.
5. Bridging scripts (undeclared): Use of protocol-external scripts to harmonize or convert formats, unintrospectable from the schema.
6. Fallback/compositional policy: Protocol-level declaration of alternates or error-contingent tool invocation.
7. Runtime schema validation: Automated, on-the-fly checks that outputs are conformant with declared schemas.
8. Typed tool registration: Complete, type-enriched interface description for programmatic discovery and agent reasoning.
9. Cross-tool provenance and traceability: Ability to trace and audit outputs back through toolchain lineage and state evolution.

These dimensions formalize the requirements for robust, agent-native compositional CV workflows, but the audit found widespread infringement along most axes.

3. Systemic Weaknesses in MCP Executors

Quantitative protocol-level audit revealed several critical fragilities in current MCP Executor deployments:

• Schema Format Divergence: 78% of systems emitted outputs or expected inputs not conforming to nominal schema (e.g., differing mask encodings—run-length, polygons, base64 images, label maps—with ambiguous type or field overloading).
• Lack of Runtime Schema Validation: 89% omitted posthoc output validation, leading to untrapped errors (e.g., channel order or shape mismatches silently propagate to downstream tools).
• Non-declaration of Coordinate Conventions: 87% did not declare, or incorrectly encoded, coordinate systems (XYWH vs. X1Y1X2Y2), leading to overlay/planning errors.
• Untracked Bridging Scripts: 41% relied on bridging code “gluing” incompatible tool outputs/inputs outside the formal protocol, destroying piecemeal traceability and impeding debugging/auditing.
• Memory Scope Errors: 33.8 warnings per 100 executions (average), denoting context scoping or staleness failures.

Issue	Prevalence (%)	Main Consequence
Schema format divergence	78.0	Compositional/handoff failures
Missing runtime validation	89.0	Silent, undetected output mismatches
Undeclared coordinate conv.	87.0	Spatial/overlay/planning errors
Bridging scripts	41.0	Untracked, unvalidated workflow segments
Untyped tool connections	89.0	Privilege escalation, type mismatch risks
Memory scoping errors	33.8 per 100 execs	Stale or misrouted state

4. Security Risks in Agentic, Multi-Agent, and Dynamic Workflows

The MPC Executor’s architectural properties introduce novel, severe attack vectors:

• Prompt/code injection: Adversarial payloads embedded in image metadata or outputs can traverse into agentic execution context, influencing downstream tool calls.
• Schema bypass: Absence of runtime verification allows malformed or malicious data to propagate across the pipeline undetected.
• Privilege escalation: Untyped or under-typed tool registration leads to data leakage—41% of systems allowed unauthorized cross-context access, and 89% lacked proper typing safeguards.
• Stale memory/provenance loss: Poor state scoping and output tagging lead to reuse of sensitive or outdated memory, impeding auditing and opening privilege overlap.
• Remote Code Execution (RCE): Insecure shell invocations or protocol-external script glue admit arbitrary code paths (vector for exploitation).

Multi-agent/distributed workflows multiply risks: blurred memory and trust boundaries expand lateral movement for compromised or unvetted agents/tools.

5. Benchmarking and Validator Suite for MCP Executors

Implementation of reproducible, executable benchmarks and validators underpins systematic audit and remediation:

• Functional validators: Schema alignment, mask–image consistency, coordinate convention checks.
• Orchestration validators: Memory scoping, fallback execution enforcement, cross-tool data lineage tracing.
• Security validators: Privilege escalation detection, untyped tool registration, cross-context auditability, prompt/code injection exposure.
• Evaluation outputs: Binary (pass/fail) plus full structured traces enable reproducibility, debugging, and benchmark extensions.
• Performance: Suite quantifies error/prevalence rates and exposes root-cause classes at deployment scale.

6. Technical Formalization

MCP Executors operationalize compositional workflow correctness by predicate and transformation formalizations:

• Compatibility predicate: Tool compatibility is formalized as

$$\operatorname{comp}: \mathcal{T} \times \mathcal{T} \rightarrow \{0,1\}$$

where $\mathcal{T}$ is the set of tool schemas; this is only weakly enforced in deployed systems.

• Workflow failure: Violation of protocol invariants is modeled by

$(A, T, M) \rightarrow (A', T', M')$

denoting transformation of agent $A$, tool $T$, and memory $M$ into states $(A', T', M')$ that break protocol-level safety/fidelity.

7. Recommendations and Strategic Implications

The audit’s central findings are that protocol-level omissions, not individual tool accuracy or agent reasoning, are the root cause of the majority of observed failures. Priority remediation measures for future MCP Executor architectures include:

• Adoption of semantically grounded, type- and role-disambiguated schemas.
• Protocol-native, contextually tagged visual memory for reproducible and auditable state handling.
• Integration of runtime validators and compatibility contract enforcement for all tool invocations.
• Transparent, fine-grained audit logging for compositional workflows and security hygiene.

Continued research is needed to extend these mechanisms into production-scale deployments and for integration with alternative orchestration frameworks that may provide additional traceability or runtime guarantees.

---

MCP Executors enable flexible, agent-native vision workflow composition but are currently undermined by widespread schema misalignment, runtime validation omissions, coordinate ambiguities, and pervasive reliance on ad hoc code outside protocol control. Comprehensive benchmarks and validator suites now afford reproducible, quantitative measurement and diagnosis. Future advances depend on protocol refinements, rigorous runtime assurance, and unambiguous schema semantics to realize robust, secure, and audit-ready MCP-based vision systems (Tiwari et al., 26 Sep 2025).