AEGIS is a policy enforcement component designed to prevent resource abuse in the Model Context Protocol (MCP), an open‑source JSON‑RPC protocol that allows large language models to interact with external systems via tools. By leveraging large language models to analyze, categorize, and normalize diverse tool invocations across text, images, video, and location modalities, AEGIS provides administrators with fine‑grained safeguards that can be enforced through the Open Policy Agent and ContextForge AI Gateway. This approach enables detection and mitigation of abusive behaviors—such as excessively large search requests or long video calls—while maintaining the flexibility of MCP‑based agent ecosystems.
arXiv:2606. 04769v1 Announce Type: cross Abstract: The Model Context Protocol (MCP) has emerged as a critical standard empowering Large Language Models (LLMs) to utilize external tools.
arXiv:2508.14925v2 Announce Type: replace-cross Abstract: By providing a standardized interface for LLM agents to interact with external tools, the Model Context Protocol (MCP) is quickly becoming a...
GatewayBench is a new evaluation framework that systematically studies how the design of Model Context Protocol (MCP) gateways influences AI agent capability, efficiency, and security. It categorizes gateways into flattened and hierarchical architectures and tests them on 524 tasks across six domains using a pool of 11,118 real-world tools from 251 MCP servers, including task-irrelevant tools to simulate large-scale deployments. Experiments on seven widely deployed gateways reveal significant differences in task completion, tool-use efficiency, and attack resilience, showing strong interactions with the underlying model and agent harness.
ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
arXiv:2606. 10749v1 Announce Type: cross Abstract: Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments.
Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing...
arXiv:2607. 25297v1 Announce Type: cross Abstract: The rapid development of large language model (LLM) agents has enabled their broad adoption across diverse real-world tasks.
arXiv:2606. 29073v1 Announce Type: cross Abstract: Model Context Protocol (MCP)-style ecosystems give language-model applications a practical connection layer for tools, resources, prompts, and transports.
arXiv:2602. 09222v2 Announce Type: replace-cross Abstract: Large language model (LLM) based web agents are increasingly deployed to automate complex online tasks by directly interacting with web sites and performing actions on users' behalf.
The paper introduces TrustShiftProbe, a framework that characterizes and defends against staged trust attacks on Model Context Protocol (MCP) servers. It defines a temporal threat model where a compromised server behaves benignly during conditioning and later delivers adversarial payloads, and presents a multi‑tier runtime defense called SHIELD that reduces attack success from 69.5% to 42.7%. The work also provides a taxonomy of nine TrustShift variants across different execution mechanisms and objectives.
arXiv:2608. 15108v1 Announce Type: cross Abstract: Large language model agents are increasingly connected to high-value resources such as computing infrastructure, credentials, usage budgets, identities, private knowledge, communication channels, and organizational workflows.
arXiv:2605. 18414v2 Announce Type: replace-cross Abstract: Large language models increasingly operate as autonomous agents that select and invoke tools from large registries.