Image de couverture de livre

Auditing MCP Servers for Over-Privileged Tool Capabilities

Fuente: arXiv

Enregistré dans:

Détails bibliographiques
Auteurs principaux:	Huang, Charoes, Huang, Xin, Fard, Amin Milani
Format:	Preprint
Publié:	2026
Sujets:	Cryptography and Security Software Engineering
Accès en ligne:	Acceder al recurso
Tags:	Ajouter un tag Pas de tags, Soyez le premier à ajouter un tag!

Documents similaires

Are AI-assisted Development Tools Immune to Prompt Injection?
par: Huang, Charoes, et autres
Publié: (2026)

Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning
par: Huang, Charoes, et autres
Publié: (2026)

From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers
par: Huang, Yiheng, et autres
Publié: (2026)

When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation
par: Zhao, Weibo, et autres
Publié: (2025)

We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystems
par: Li, Zhihao, et autres
Publié: (2025)

MCP-SandboxScan: WASM-based Secure Execution and Runtime Analysis for MCP Tools
par: Tan, Zhuoran, et autres
Publié: (2026)

TAC: Hybrid IAM Privilege Escalation Detection
par: Hu, Yang, et autres
Publié: (2023)

Who Tests the Testers? Systematic Enumeration and Coverage Audit of LLM Agent Tool Call Safety
par: Chen, Xuan, et autres
Publié: (2026)

Fuzzing Frameworks for Server-side Web Applications: A Survey
par: Dharmaadi, I Putu Arya, et autres
Publié: (2024)

Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem
par: Song, Hao, et autres
Publié: (2025)

Uncovering EDK2 Firmware Flaws: Insights from Code Audit Tools
par: Farahani, Mahsa, et autres
Publié: (2024)

Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence
par: Zhang, Junan, et autres
Publié: (2023)

RepoMark: A Data-Usage Auditing Framework for Code Large Language Models
par: Qu, Wenjie, et autres
Publié: (2025)

The Data Enclave Advantage: A New Paradigm for Least-Privileged Data Access in a Zero-Trust World
par: Bistolfi, Nico, et autres
Publié: (2025)

SkillProbe: Security Auditing for Emerging Agent Skill Marketplaces via Multi-Agent Collaboration
par: Guo, Zihan, et autres
Publié: (2026)

Detecting Privilege Escalation in Polyglot Microservices via Agentic Program Analysis
par: Li, Penghui, et autres
Publié: (2026)

Characterizing JavaScript Security Code Smells
par: Kambhampati, Vikas, et autres
Publié: (2024)

SafeToolBench: Pioneering a Prospective Benchmark to Evaluating Tool Utilization Safety in LLMs
par: Xia, Hongfei, et autres
Publié: (2025)

Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization
par: Li, Ying, et autres
Publié: (2026)

Evaluating Tool Cloning in Agentic-AI Ecosystems
par: Kim, Taein, et autres
Publié: (2026)

OTA-Key: Over the Air Key Management for Flexible and Reliable IoT Device Provision
par: Zhang, Qian, et autres
Publié: (2024)

ELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space
par: Chen, Chuyang, et autres
Publié: (2025)

SBOM Generation Tools in the Python Ecosystem: an In-Detail Analysis
par: Cofano, Serena, et autres
Publié: (2024)

Uncover the Premeditated Attacks: Detecting Exploitable Reentrancy Vulnerabilities by Identifying Attacker Contracts
par: Yang, Shuo, et autres
Publié: (2024)

Security Is Relative: Training-Free Vulnerability Detection via Multi-Agent Behavioral Contract Synthesis
par: Wang, Yongchao, et autres
Publié: (2026)

Guardrails as Infrastructure: Policy-First Control for Tool-Orchestrated Workflows
par: Sigdel, Akshey, et autres
Publié: (2026)

PentestGPT: An LLM-empowered Automatic Penetration Testing Tool
par: Deng, Gelei, et autres
Publié: (2023)

VulnRepairEval: An Exploit-Based Evaluation Framework for Assessing Large Language Model Vulnerability Repair Capabilities
par: Wang, Weizhe, et autres
Publié: (2025)

Centralized Defense: Logging and Mitigation of Kubernetes Misconfigurations with Open Source Tools
par: Russell, Eoghan, et autres
Publié: (2024)

Building a Cybersecurity Risk Metamodel for Improved Method and Tool Integration
par: Ponsard, Christophe
Publié: (2024)

LSPFuzz: Hunting Bugs in Language Servers
par: Zhu, Hengcheng, et autres
Publié: (2025)

Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbation
par: Chang, Shuyu, et autres
Publié: (2026)

HyperPUT: Generating Synthetic Faulty Programs to Challenge Bug-Finding Tools
par: Felici, Riccardo, et autres
Publié: (2022)

Smart Contract and DeFi Security Tools: Do They Meet the Needs of Practitioners?
par: Chaliasos, Stefanos, et autres
Publié: (2023)

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents
par: Dong, Ben, et autres
Publié: (2026)

ChainFuzzer: Greybox Fuzzing for Workflow-Level Multi-Tool Vulnerabilities in LLM Agents
par: Wu, Jiangrong, et autres
Publié: (2026)

UniBOM -- A Unified SBOM Analysis and Visualisation Tool for IoT Systems and Beyond
par: Safronov, Vadim, et autres
Publié: (2025)

Unity is Strength: Enhancing Precision in Reentrancy Vulnerability Detection of Smart Contract Analysis Tools
par: Wang, Zexu, et autres
Publié: (2024)

From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis
par: Zhou, Dongchao, et autres
Publié: (2025)

HarnessAgent: Scaling Automatic Fuzzing Harness Construction with Tool-Augmented LLM Pipelines
par: Yang, Kang, et autres
Publié: (2025)