MCP-Artifact

This repository contains the artifacts for the paper “Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem”

Specifically, it includes the Uploaded MCP Servers in our experiment RQ1, the User Study in our experiment RQ2, and the LLM evaluation in our experiment RQ3.

Ethical Statement & Disclaimer

THIS ARTIFACT IS INTENDED SOLELY FOR ACADEMIC RESEARCH.

• No Harm Caused: The malicious MCP server code used for testing aggregation platform audit mechanisms in RQ1 contained no actual malicious functionality. Its documentation clearly disclosed its simulated malicious intent. No real users or real-world systems were harmed or affected by our tests. We removed all tested components from the aggregation platforms immediately after the study.
• Simulated Environments: All experiments involving malicious behavior (e.g., PoCs for RQ3) were conducted in controlled and simulated environments to prevent any real-world harm or unauthorized access. The simulated MCP server aggregation platform (for RQ2) was explicitly designed for research and did not interact with real users or systems outside of our controlled study participants.
• User Study & Data Privacy: The user study and interviews (for RQ2) were conducted under strict IRB guidelines. All participants provided informed consent, and all collected data (including interview transcripts and survey responses) have been anonymized to maintain confidentiality and protect personal information.
• Responsible Disclosure: Our findings are intended to inform the broader community about potential security vulnerabilities in the emerging MCP ecosystem and to encourage the development of robust defense mechanisms. This artifact is provided for verification and replication of our research findings only.
• Use at Your Own Risk: Any unauthorized use, modification, or deployment of the code and materials in this repository for malicious or harmful purposes is strictly prohibited and against the intent of this research. The authors are not responsible for any misuse.

---

Overview of the Artifact

This artifact is organized into three main sections corresponding to our research questions (RQs):

RQ1. Malicious MCP Server Upload Test

This section contains the code for the simulated malicious MCP servers used in our RQ1 upload tests. The code was designed to test the audit mechanisms of aggregation platforms but contains no actual malicious functionality.