Title: ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control Show Chinese title

Title: ETDI：通过使用OAuth增强的工具定义和基于策略的访问控制来减轻模型上下文协议（MCP）中的工具劫持和 rug 拉攻击

Abstract: The Model Context Protocol (MCP) plays a crucial role in extending the capabilities of Large Language Models (LLMs) by enabling integration with external tools and data sources. However, the standard MCP specification presents significant security vulnerabilities, notably Tool Poisoning and Rug Pull attacks. This paper introduces the Enhanced Tool Definition Interface (ETDI), a security extension designed to fortify MCP. ETDI incorporates cryptographic identity verification, immutable versioned tool definitions, and explicit permission management, often leveraging OAuth 2.0. We further propose extending MCP with fine-grained, policy-based access control, where tool capabilities are dynamically evaluated against explicit policies using a dedicated policy engine, considering runtime context beyond static OAuth scopes. This layered approach aims to establish a more secure, trustworthy, and controllable ecosystem for AI applications interacting with LLMs and external tools. Show Chinese abstract

Abstract: 模型上下文协议（MCP）在通过启用外部工具和数据源的集成来扩展大型语言模型（LLMs）的能力方面发挥着至关重要的作用。然而，标准的MCP规范存在显著的安全漏洞，特别是工具投毒和地毯式攻击。 本文介绍了增强型工具定义接口（ETDI），这是一种旨在强化MCP的安全扩展。ETDI结合了加密身份验证、不可变的版本化工具定义以及显式的权限管理，通常利用OAuth 2.0。我们进一步建议通过基于细粒度策略的访问控制扩展MCP，在专用策略引擎中动态评估工具能力是否符合明确策略，考虑运行时上下文而非静态OAuth范围。这种方法旨在为与LLMs和外部工具交互的AI应用建立一个更安全、可信且可控的生态系统。