Metraipolis › archive › dc_657aba4172da

When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts — arXiv:2611.02527

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.02527
License (as archived): CC0-1.0
Archived: 2026-11-03T18:33:18.348Z
SHA-256 of the archived text: bf47d6e290261c2a84982cc3f26419dda9a8da4ca7315258ecc0de714ce9ce1b
Stable URL of this page: https://metraipolis.com/documento/dc_657aba4172da

How to cite

When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts — arXiv:2611.02527 — arXiv (en), https://arxiv.org/abs/2611.02527 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_657aba4172da (Metraipolis archive dc_657aba4172da, sha256 bf47d6e290261c2a84982cc3f26419dda9a8da4ca7315258ecc0de714ce9ce1b)

BibTeX

@misc{dc657aba4172da,
  title = {When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts — arXiv:2611.02527},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.02527},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_657aba4172da; sha256 bf47d6e290261c2a84982cc3f26419dda9a8da4ca7315258ecc0de714ce9ce1b},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.02527. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

LLM agents call tools that delete data or move money through the Model Context Protocol (MCP). The specification asks for a human who can deny tool calls but splits the mechanism between the server, which can annotate a tool or ask the user through the host (elicitation), and the host application, which decides whether to prompt. We measure both sides from source code. In a 1,000-repository sample of the official MCP registry, an estimated 90% of destructive tools (95% CI 82-95) have no server-side confirmation, and most servers that elicit proceed, or fall back to a flag the model can set, when the host cannot relay the question. Of 41 popular open-source hosts and agent SDKs, 32 have no approval step by default, including 16 of 25 applications. Pairing sampled destructive tools flagged by a rule-based extractor with these applications, 60.7% of pairs have no enforced human approval by default. Through four agent SDKs, four of five low-cost models executed an injected deletion in 479 of 960 runs. If hosts prompted for every tool not annotated read-only or non-destructive, the unapproved share of these pairs would fall to 5.4%; universal elicitation support would leave 56.7%. Applications should therefore configure approval.

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Software Engineering (cs.SE) ; Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2611.02527 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T18:12:23.825Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).