--- title: "Securing the Tool Layer — paper by Yergattikar (2026)" description: "The paper presents ShieldMCP, which has two parts. 4 references. Among them: 0." authors: ["Saurabh Yergattikar"] year: 2026 venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 6: Industry Track)" source: "https://aclanthology.org/2026.acl-industry.58/" doi: "10.18653/v1/2026.acl-industry.58" licence: "CC BY 4.0 (ACL Anthology)" licence_url: "https://creativecommons.org/licenses/by/4.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/yergattikar-2026-securing-tool-layer-threat-taxonomy/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/yergattikar-2026-securing-tool-layer-threat-taxonomy/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/49/) / Securing the Tool Layer: A Threat Taxonomy and Runtime Defense Framework for Model Context Protocol Deployments # Securing the Tool Layer: A Threat Taxonomy and Runtime Defense Framework for Model Context Protocol Deployments **Authors:** Saurabh Yergattikar · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 6: Industry Track)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/) **Links:** [Publisher's page](https://aclanthology.org/2026.acl-industry.58/) · [PDF](https://aclanthology.org/2026.acl-industry.58.pdf) · [DOI 10.18653/v1/2026.acl-industry.58](https://doi.org/10.18653/v1/2026.acl-industry.58) · [OpenAlex](https://openalex.org/W7166863805) **Citations:** 0 citations (OpenAlex, 2026-10-14) ## Summary Agents that use external tools through the Model Context Protocol (MCP) can be compromised through the tools themselves rather than through the user. Attackers can poison tool metadata, hide instructions in returned data, or publish malicious server packages. Existing guardrails such as LlamaFirewall and NeMo Guardrails largely do not inspect this layer. The paper presents ShieldMCP, which has two parts. First, it condenses the 80+ techniques catalogued by the SAFE-MCP initiative into five priority attack families. Second, it adds a transparent proxy between client and servers that needs no changes to either side. The proxy checks traffic in three stages: - **Tool descriptions:** a hash registry, an anomaly scan, and a distilled intent classifier. - **Outbound parameters:** sanitization of the arguments the agent sends. - **Tool responses:** token-level instruction detection, untrusted-data delimiters, and a session dependency graph. In red-team tests across five LLM backends, average attack success fell from 70.9% to 9.5%. This beat both regex and LLM-judge baselines, with under 120ms of median added latency. The result points to a practical drop-in defense for production MCP use, although chained cross-tool attacks remain the weakest spot. ## Key points - **Taxonomy:** SAFE-MCP (OpenSSF, Linux Foundation) is adapted from MITRE ATT&CK and covers 14 tactic categories. The paper reduces it to five families: tool poisoning, indirect prompt injection via responses, supply chain compromise, rug pulls, and cross-tool chains. - **Classifier:** the description classifier is distilled from a 3B-parameter model. It was fine-tuned on 8,400 benign and 3,200 adversarial descriptions, and items scoring above τ_d = 0.72 are quarantined for human review. - **Attack success rates:** tool poisoning fell from 74.1% to 8.6%, indirect injection via responses from 47.2% to 5.8%, and cross-tool chains from 91.3% to 14.2%. - **Test setup and review:** the harness used 40 MCP servers (25 benign, 15 adversarial). Three security engineers reviewing 50 alerts matched the ground truth in 92% of cases. - **Limitations:** the classifier is trained only on English, cross-call correlation scales quadratically, and robustness to adaptive attackers is untested. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* 📚 Shelves (3): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🌐 Computer Networks and Communications](https://md.research.elamur.ai/free/en/shelves/computer-science/computer-networks-and-communications/) · 100 works ## Cite Cite as: Saurabh Yergattikar. 2026. Securing the Tool Layer: A Threat Taxonomy and Runtime Defense Framework for Model Context Protocol Deployments. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 6: Industry Track). The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @inproceedings{yergattikar2026securing, title = {{Securing the Tool Layer: A Threat Taxonomy and Runtime Defense Framework for Model Context Protocol Deployments}}, author = {Saurabh Yergattikar}, booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 6: Industry Track)}, year = {2026}, doi = {10.18653/v1/2026.acl-industry.58}, url = {https://doi.org/10.18653/v1/2026.acl-industry.58} } ``` - [← previous SecureGate: Learning When to Reveal PII Safely via Token-Gated Dual-Adapters for Federated LLMs](https://md.research.elamur.ai/free/en/papers/shaaban-2026-securegate-learning-when-reveal-pii/) - [next → SeDev: Structured Semantic Exploration for LLM-Driven Code Generation](https://md.research.elamur.ai/free/en/papers/yang-2026-sedev-structured-semantic-exploration-llm/) - [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/49/) ## References 4 references, 0 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet. 1. Hengyu An, Jinghuai Zhang, Tianyu Du, Chunyi Zhou, Qingming Li, Tao Lin, and Shouling Ji. 2025. IPI-Guard: A novel tool dependency graph-based defense against indirect prompt injection in LLM agents. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. [find](https://scholar.google.com/scholar?q=Hengyu+An%2C+Jinghuai+Zhang%2C+Tianyu+Du%2C+Chunyi+Zhou%2C+Qingming+Li%2C+Tao+Lin%2C+and+Shouling+Ji%2E+2025%2E+IPI%2DGuard%3A+A+novel+tool+dependency+graph%2Dbased+defense+against+indirect+prompt+injection+in+LLM+agents%2E+) 2. Christoph Bühler, Matteo Biagiola, L. Grazia, and Guido Salvaneschi. 2025. Securing AI agent execution. In arXiv preprint arXiv:2507.12345. — [arXiv:2507.12345](https://arxiv.org/abs/2507.12345) [find](https://scholar.google.com/scholar?q=Christoph+B%C3%BChler%2C+Matteo+Biagiola%2C+L%2E+Grazia%2C+and+Guido+Salvaneschi%2E+2025%2E+Securing+AI+agent+execution%2E+In+arXiv+preprint+arXiv%3A2507%2E12345%2E+%E2%80%94+%5BarXiv%3A2507%2E12345%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2507%2E12345%29) 3. Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. 2024. StruQ: Defending against prompt injection with structured queries. In USENIX Security Symposium. [find](https://scholar.google.com/scholar?q=Sizhe+Chen%2C+Julien+Piet%2C+Chawin+Sitawarin%2C+and+David+Wagner%2E+2024%2E+StruQ%3A+Defending+against+prompt+injection+with+structured+queries%2E+In+USENIX+Security+Symposium%2E) 4. Sizhe Chen, Arman Zharmagambetov, David Wagner, and Chuan Guo. 2025. Meta SecAlign: A secure foundation LLM against prompt injection attacks. In arXiv preprint arXiv:2507.01111. \#\# Ethical Considerations — [arXiv:2507.01111](https://arxiv.org/abs/2507.01111) [find](https://scholar.google.com/scholar?q=Sizhe+Chen%2C+Arman+Zharmagambetov%2C+David+Wagner%2C+and+Chuan+Guo%2E+2025%2E+Meta+SecAlign%3A+A+secure+foundation+LLM+against+prompt+injection+attacks%2E+In+arXiv+preprint+arXiv%3A2507%2E01111%2E+%5C%23%5C%23+Ethical+Considera) *Updated 2 November 2026*