From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes

• URL: http://arxiv.org/abs/2606.29073v1
• Date: Sat, 27 Jun 2026 20:17:43 GMT
• Title: From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
• Abstract summary: As agents move from connection to execution, security decisions often remain split across clients, servers, prompts, approval dialogs, deployments, and logs.<n>This paper asks whether a runtime can make execution-layer invariants explicit and testable while preserving MCP-like ecosystems.<n>We implement these invariants in HCP, a Handle-Capability Protocol reference runtime for MCP-style agent execution.
• Score: 8.419155861590548
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Model Context Protocol (MCP)-style ecosystems give language-model applications a practical connection layer for tools, resources, prompts, and transports. As agents move from connection to execution, security decisions often remain split across clients, servers, prompts, approval dialogs, OAuth deployments, and logs. This paper asks whether a runtime can make execution-layer invariants explicit and testable while preserving MCP-like workflows. We define eight invariants: metadata non-authority, grant-backed approval, canonical resources, principal binding, scoped capability invocation, source-and-target data-flow authorization, deny-path audit, and explicit protocol state. We implement these invariants in HCP, a Handle-Capability Protocol reference runtime for MCP-style agent execution that represents calls through principals, resources, grants, capabilities, handles, policy decisions, data-pipe checks, and audit entries. We evaluate HCP against two MCP-like baselines: a naive connection-layer runtime and a practice-informed connection-layer mitigation baseline with metadata linting, session checks, and per-call approvals. Across 10 benchmark cases, the naive baseline permits all modeled attacks, the mitigation baseline permits 6 of 10, and HCP blocks all 10 while preserving audit evidence. Ablations identify which runtime components block attacks and preserve forensic evidence. A local in-memory microbenchmark reports sub-millisecond mean latencies for measured policy, invocation, peek, and pipe operations. A bounded GitHub README-screening sample provides ecosystem signals, not vulnerability findings. The results support a narrow claim: MCP-style agent systems need an execution-control layer in addition to connection-layer conventions.

Related papers

• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Formal Verification of Agentic Systems over Operational Data [59.98246281888422]
  Agentic systems driven by large language models (LLMs) are increasingly deployed in real-world where they act on persistent operational data.<n>Existing approaches do not provide such system-level guarantees.<n>We study here the verification of agentic systems comprising a single LLM and a tool orchestration harness over relational operational data.
  arXiv  Detail & Related papers  (2026-08-04T13:01:30Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems [0.6526824510982799]
  This paper presents a runtime-semantics layer for converting heterogeneous agent activity into canonical runtime objects.<n>The contribution is a systems formulation of action-level canonicalization and policy-addressable semantic patterns as a necessary substrate for deployer-side AI governance.
  arXiv  Detail & Related papers  (2026-07-15T11:34:34Z)
• A Technical Taxonomy of LLM Agent Communication Protocols [60.76747983053368]
  This study develops a technical taxonomy to classify and analyze large language models (LLMs) agent communication protocols.<n>The framework guides protocol selection and highlights open research gaps such as privacy and policy enforcement.
  arXiv  Detail & Related papers  (2026-06-17T14:45:20Z)
• Proof-Carrying Agent Actions: Model-Agnostic Runtime Governance for Heterogeneous Agent Systems [0.6526824510982799]
  This paper presents Proof-Carrying Agent Actions (PCAA), a runtime-neutral governance model centered on an action certificate.<n>PCAA organizes control around five checkpoints: pre-action admissibility, action open, assumption capture, approval, and outcome closure.<n>We study the model through a reference implementation in a heterogeneous agent control plane and a disclosure-bounded evaluation protocol.
  arXiv  Detail & Related papers  (2026-06-02T18:10:35Z)
• An Organization-Scoped LLM Agent Runtime Architecture for Regulated Cybersecurity Operations [0.3013679260442808]
  Regulated cybersecurity lack a runtime substrate that enforces organization-level scope.<n>Recent large language model (LLM) agent systems report strong results on isolated cybersecurity tasks.<n>This paper proposes an organization-scoped agent runtime architecture for financial cybersecurity.
  arXiv  Detail & Related papers  (2026-05-28T21:51:38Z)
• An Executable Benchmarking Suite for Tool-Using Agents [3.5322131912413908]
  The suite connects WebArena Verified, a SWE-Gym slice with SWE-bench-compatible verification, and MiniWoB++ through common workload adapters.<n>The admitted evidence records latency, invalid-action behavior, patch-generation cost, verifier metadata, replay bindings, and provenance under one auditable contract.
  arXiv  Detail & Related papers  (2026-05-10T21:24:53Z)
• Autogenesis: A Self-Evolving Agent Protocol [60.15939127351914]
  We introduce Autogenesis Protocol (AGP), a self evolution protocol that decouples what evolves from how evolution occurs.<n>We present Autogenesis System (AGS), a self-evolving multi-agent system that dynamically instantiates, retrieves, and refines protocol-registered resources during execution.
  arXiv  Detail & Related papers  (2026-04-16T14:04:06Z)
• DEP: A Decentralized Large Language Model Evaluation Protocol [51.3646001384887]
  Decentralized Evaluation Protocol (DEP) is a decentralized yet unified and standardized evaluation framework.<n>By decoupling users, LLMs, and benchmarks, DEP enables modular, plug-and-play evaluation.<n>We develop DEP Toolkit, a protocol-compatible toolkit that supports features such as breakpoint resume, concurrent requests, and congestion control.
  arXiv  Detail & Related papers  (2026-03-01T16:10:16Z)
• OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access [11.289770127178882]
  This paper introduces OpenPort Protocol, a governance-first specification for exposing application tools through a secure server-side gateway.<n>OpenPort defines authorization-dependent discovery, stable response envelopes with machine-actionable texttagent.* reason codes, and an authorization model combining integration credentials, scoped permissions, and ABAC-style policy constraints.<n>For write operations, OpenPort specifies a risk-gated lifecycle that defaults to draft creation and human review, supports time-bounded auto-execution under explicit policy, and enforces high-risk safeguards including preflight impact binding and idempotency
  arXiv  Detail & Related papers  (2026-02-22T05:16:40Z)
• From Tool Orchestration to Code Execution: A Study of MCP Design Choices [20.817336331051752]
  Model Context Protocols (MCPs) provide a unified platform for agent systems to discover, select, and orchestrate tools across heterogeneous execution environments.<n>Recent MCP designs have incorporated code execution as a first-class capability, an approach called Code Execution MCP (CEMCP)<n>This work formalizes the architectural distinction between context-coupled (traditional) and context-decoupled (CEMCP) models, analyzing their fundamental scalability trade-offs.
  arXiv  Detail & Related papers  (2026-02-17T19:03:08Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints [59.645885492637845]
  SOPBench is an evaluation pipeline that transforms each service-specific SOP code program into a directed graph of executable functions.<n>Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions.<n>We evaluate 18 leading models, and results show the task is challenging even for top-tier models.
  arXiv  Detail & Related papers  (2025-03-11T17:53:02Z)
• Commit0: Library Generation from Scratch [77.38414688148006]
  Commit0 is a benchmark that challenges AI agents to write libraries from scratch.<n>Agents are provided with a specification document outlining the library's API as well as a suite of interactive unit tests.<n> Commit0 also offers an interactive environment where models receive static analysis and execution feedback on the code they generate.
  arXiv  Detail & Related papers  (2024-12-02T18:11:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.