Cover Image

We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystems

Fuente: arXiv

Saved in:

Bibliographic Details
Main Authors:	Li, Zhihao, Li, Kun, Ma, Boyang, Xu, Minghui, Zhang, Yue, Cheng, Xiuzhen
Format:	Preprint
Published:	2025
Subjects:	Cryptography and Security Artificial Intelligence Software Engineering
Online Access:	Acceder al recurso
Tags:	Add Tag No Tags, Be the first to tag this record!

Similar Items

Auditing MCP Servers for Over-Privileged Tool Capabilities
by: Huang, Charoes, et al.
Published: (2026)

Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem
by: Song, Hao, et al.
Published: (2025)

Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization
by: Li, Ying, et al.
Published: (2026)

MCP-SandboxScan: WASM-based Secure Execution and Runtime Analysis for MCP Tools
by: Tan, Zhuoran, et al.
Published: (2026)

When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation
by: Zhao, Weibo, et al.
Published: (2025)

Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions
by: Li, Zhihao, et al.
Published: (2026)

From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers
by: Huang, Yiheng, et al.
Published: (2026)

Detecting Privilege Escalation in Polyglot Microservices via Agentic Program Analysis
by: Li, Penghui, et al.
Published: (2026)

When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems
by: Wang, Su, et al.
Published: (2026)

Machine Learning-Based Detection of MCP Attacks
by: Mattsson, Tobias, et al.
Published: (2026)

Protect Your Secrets: Understanding and Measuring Data Exposure in VSCode Extensions
by: Liu, Yue, et al.
Published: (2024)

When Specifications Meet Reality: Uncovering API Inconsistencies in Ethereum Infrastructure
by: Ma, Jie, et al.
Published: (2026)

A Multi-Store Privacy Measurement of Virtual Reality App Ecosystem
by: Yan, Chuan, et al.
Published: (2025)

Generating API Parameter Security Rules with LLM for API Misuse Detection
by: Liu, Jinghua, et al.
Published: (2024)

TAC: Hybrid IAM Privilege Escalation Detection
by: Hu, Yang, et al.
Published: (2023)

Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems
by: Huang, Yuhang, et al.
Published: (2026)

GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing
by: Tsai, Omar, et al.
Published: (2025)

Mutation-based Evaluation of Cryptographic API Misuse Detectors
by: Ami, Amit Seal, et al.
Published: (2021)

Does the Vulnerability Threaten Our Projects? Automated Vulnerable API Detection for Third-Party Libraries
by: Zhang, Fangyuan, et al.
Published: (2024)

How Far Have We Gone in Binary Code Understanding Using Large Language Models
by: Shang, Xiuwei, et al.
Published: (2024)

BacAlarm: Mining and Simulating Composite API Traffic to Prevent Broken Access Control Violations
by: Yang, Yanjing, et al.
Published: (2025)

"MCP Does Not Stand for Misuse Cryptography Protocol": Uncovering Cryptographic Misuse in Model Context Protocol at Scale
by: Yan, Biwei, et al.
Published: (2025)

An Investigation of Patch Porting Practices of the Linux Kernel Ecosystem
by: Li, Xingyu, et al.
Published: (2024)

RepoMark: A Data-Usage Auditing Framework for Code Large Language Models
by: Qu, Wenjie, et al.
Published: (2025)

From Struggle to Simplicity with a Usable and Secure API for Encryption in Java
by: Firouzi, Ehsan, et al.
Published: (2024)

Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode
by: Ji, Zimo, et al.
Published: (2026)

Enhancing REST API Fuzzing with Access Policy Violation Checks and Injection Attacks
by: Sahin, Omur, et al.
Published: (2026)

LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs' Vulnerability Reasoning
by: Sun, Yuqiang, et al.
Published: (2024)

Zero-Permission Manipulation: Can We Trust Large Multimodal Model Powered GUI Agents?
by: Qian, Yi, et al.
Published: (2026)

Automatically Detecting Checked-In Secrets in Android Apps: How Far Are We?
by: Li, Kevin, et al.
Published: (2024)

What's in a Package? Getting Visibility Into Dependencies Using Security-Sensitive API Calls
by: Rahman, Imranur, et al.
Published: (2024)

Behavioral Consistency and Transparency Analysis on Large Language Model API Gateways
by: Lin, Guanjie, et al.
Published: (2026)

LLM Agents for Automated Web Vulnerability Reproduction: Are We There Yet?
by: Liu, Bin, et al.
Published: (2025)

SAEL: Leveraging Large Language Models with Adaptive Mixture-of-Experts for Smart Contract Vulnerability Detection
by: Yu, Lei, et al.
Published: (2025)

Sandboxing Adoption in Open Source Ecosystems
by: Alhindi, Maysara, et al.
Published: (2024)

A Large-scale Fine-grained Analysis of Packages in Open-Source Software Ecosystems
by: Zhou, Xiaoyan, et al.
Published: (2024)

SCRUTINEER: Detecting Logic-Level Usage Violations of Reusable Components in Smart Contracts
by: Lin, Xingshuang, et al.
Published: (2025)

Towards Agentic Runtime Healing
by: Sun, Zhensu, et al.
Published: (2024)

An Empirical Study of Vulnerabilities in Python Packages and Their Detection
by: Quan, Haowei, et al.
Published: (2025)

Evaluating Tool Cloning in Agentic-AI Ecosystems
by: Kim, Taein, et al.
Published: (2026)