Your MCP Server Executes Commands - But From Whom?
summary
Every byte an MCP server sends can be weaponized: fuzzing the auto‑generated JSON schema produces Full‑Schema Poisoning (FSP) where malicious payloads hide in parameter names, types, defaults and required arrays, and post‑execution errors inject prompts in runtime strings — Advanced Tool‑Poisoning Attacks (ATPA) — that coerce agents to leak secrets and chain remote MCP calls while evading static analysis. Demonstrations use Wireshark interception, modified schema fields and a malicious external API; countermeasures include strict typed return schemas, title stripping or proxying, allow‑listing, runtime differential audits and an output classifier.
AI-written summary · about
chapters (18)
- 0:00Introduction to the crime
- 2:23Agenda and investigation plan
- 3:06How LLMs learned to use tools
- 6:23Introduction to MCP protocol
- 8:08MCP tool definition and schema
- 9:51Investigating the weather tool
- 10:36Understanding prompt injection
- 13:06MCP server as potential attacker
- 14:31Indirect prompt injection in descriptions
- 17:29JSON schema as attack vector
- 21:53Eliminating description and schema suspects
- 22:35Tool output as entry point
- 24:50The innocent MCP developer
- 25:52Crime location weapon and entry point
- 26:37Mitigating MCP server attacks
- 28:25Mitigating tool output risks
- 30:33Summary of attacks and defenses
- 31:36Q&A session
related talks
44mSupercharging DevOps with MCP (Without Opening a Security Hole)
13mCloud MCP Servers Under Fire
24mThese Aren't the Tools You're Looking For: MCP Security Awakens
45mMCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)
55mYour MCP Server is Bad (and you should feel bad)
22mSAFE-MCP: A Security Framework for AI+MCP (Model Context Protocol)
25mYour Insecure MCP Server Won't Survive Production
26mWho Let the Agent In? Securing MCP Servers in Production