Metraipolis › archive › dc_b3e8a6731baa

Where Does MCP Security End? A Three-Tier Mitigation Mapping Framework for the OWASP MCP Top 10 — arXiv:2611.02611

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.02611
License (as archived): CC0-1.0
Archived: 2026-11-03T11:17:17.474Z
SHA-256 of the archived text: 55f32ff3c3deb8e1c0cacb052f83ccf2fa84b163c71f9b1a15cfdc911ced0cae
Stable URL of this page: https://metraipolis.com/documento/dc_b3e8a6731baa

How to cite

Where Does MCP Security End? A Three-Tier Mitigation Mapping Framework for the OWASP MCP Top 10 — arXiv:2611.02611 — arXiv (en), https://arxiv.org/abs/2611.02611 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_b3e8a6731baa (Metraipolis archive dc_b3e8a6731baa, sha256 55f32ff3c3deb8e1c0cacb052f83ccf2fa84b163c71f9b1a15cfdc911ced0cae)

BibTeX

@misc{dcb3e8a6731baa,
  title = {Where Does MCP Security End? A Three-Tier Mitigation Mapping Framework for the OWASP MCP Top 10 — arXiv:2611.02611},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.02611},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_b3e8a6731baa; sha256 55f32ff3c3deb8e1c0cacb052f83ccf2fa84b163c71f9b1a15cfdc911ced0cae},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.02611. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

The Model Context Protocol (MCP) has become a leading standard for connecting Large Language Models (LLMs) to external tools, software, and data sources. MCP architecture favors ease of integration over security, blending the data and control planes into a single natural language channel. This introduces confused deputy and prompt injection vulnerabilities that cannot be completely mitigated in the software development lifecycle (SDLC) of an MCP server. Structured security guidance for server developers has been outpaced by this adoption trend, leaving them without a clear way to identify where vulnerabilities can be addressed at the server layer and where architectural constraints create hard limits. This paper presents a framework based on OWASP MCP Top 10 mapped to three architectural tiers, developed using Design Science Research (DSR). Vulnerabilities are classified as server-primary, gateway-primary, or protocol-primary applying a cascading decision tree following four questions, resulting in reproducible tier assignments and confidence levels independent of who applies it. The framework was validated against an enterprise-grade Managed File Transfer (MFT) MCP server built in Go. Validation results showed that high-confidence server-tier controls worked as predicted, and low-confidence protocol-tier controls failed for architectural reasons beyond server implementation. The architectural ceiling encountered during practical validation is the main contribution and shows how secure-by-design development can reduce the MCP attack surface but not completely mitigate it.

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2611.02611 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T11:02:07.225Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).