MCP Protocol-Level Flaws: An Architectural Problem

In 2026 the first formal security analysis of the Model Context Protocol (MCP) specification was published — and it found not implementation bugs but three architectural flaws: unattested capabilities, unauthenticated sampling, and implicit trust propagation. Across 847 attack scenarios, the paper shows MCP's design choices amplify attack success by 23-41% compared with non-MCP integrations. Patching implementations alone cannot fix this; the protocol itself must be revised.

Three Protocol-Level Flaws

The first is missing capability attestation. When an MCP server connects, it declares the capabilities it holds — reading files, accessing the network — but the client cannot verify these claims against any authoritative source. An attacker can have a server declare only the resources capability, then later invoke sampling/createMessage to inject prompts into the model. The spec does not enforce capability at the message level, violating least privilege directly.

The second is bidirectional sampling without origin authentication. MCP lets a server issue sampling requests, but the spec does not require the host to distinguish server-injected prompts from user-originated ones. An attacker-controlled server can impersonate the user and issue calls that appear to come from the user. The paper notes the spec permits servers to use the user role in sampling without requiring hosts to tag the origin — the attack is enabled, not merely unimplemented.

The third is implicit trust propagation. In multi-server deployments the client connects to several servers at once, but the spec defines no isolation boundaries. Server A's tool responses enter a shared context window that influences calls to Server B — with no provenance tracking and no flow control. An adversary controlling A can induce calls to B's tools, exfiltrate B's data, and establish persistence by poisoning shared context. This violates isolation: compromise of one component should not propagate to others.

Why These Are Architectural, Not Implementation, Flaws

Disclosed MCP CVEs (e.g. CVE-2025-49596, CVE-2025-68143) are implementation bugs that specific code fixes can resolve. These three flaws come from the spec's design silence: it does not mandate capability enforcement, does not require origin tagging, and does not define isolation boundaries. This is abuse enabled by omission — implementation hardening cannot eliminate flaws that sit at the protocol contract level. The paper's conclusion is direct: MCP's security weaknesses are architectural and require protocol-level remediation.

How the Protocol Design Amplifies Attack Success

To isolate the protocol's own effect, the authors built PROTOAMP, adapting established agent security benchmarks to MCP infrastructure and running 847 attack scenarios across five MCP server implementations. The results are consistent: MCP's architectural choices amplify attack success by 23-41% compared with equivalent non-MCP integrations. This is the first measurement that separates protocol effects from implementation defects — proving the threat comes from the design, not from one vendor's code.

Clients Fail Too: Tool Poisoning

Beyond protocol-level issues, client-side defenses are also weak. A threat-modeling and empirical study of MCP clients used STRIDE and DREAD across five components, identifying 57 threats and focusing on tool poisoning — malicious instructions embedded in tool metadata (descriptions, parameters, prompts). Of seven major MCP clients tested, five do not statically validate server-provided tool metadata. Because the MCP spec does not require client-side validation, the LLM treats poisoned tool descriptions as authoritative instructions, calling restricted tools and leaking sensitive data.

The Fix: Protocol Revision and ATTESTMCP

The paper also proposes ATTESTMCP, a backward-compatible extension: servers must prove capabilities via signed certificates; all JSON-RPC messages get HMAC-SHA256 signatures binding content to the authenticated server identity; sampling requests carry origin tags; cross-server information flow requires explicit user authorization; and replay protection uses timestamp-plus-nonce. Experiments show ATTESTMCP cuts attack success from 52.8% to 12.4%, with a median latency overhead of about 8.3ms per message — an acceptable cost, proving protocol-level hardening is realistic.

The OOMeta View

For enterprises, MCP has become the de facto standard for agents to reach external tools, yet it remains a design-level unhardened channel. The controllable move is not to wait for a protocol revision but to establish boundaries at the gateway and infrastructure layer: capability verification, origin tagging, server isolation, tool allowlists. When agents begin to select tools and act across systems autonomously, security must shift from trusting a model to verifying that the whole system holds its boundaries under unexpected behavior — exactly what MCP protocol-level analysis points toward.

References: Maloyan & Namiot, "Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents", arXiv 2601.17549, https://arxiv.org/html/2601.17549 · Huang et al., "Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning", arXiv 2603.22489, https://arxiv.org/html/2603.22489 · OWASP, "MCP Tool Poisoning", https://owasp.org/www-community/attacks/MCP_Tool_Poisoning