Hybrid Analysis for Secure MCP Tool Use in LLM Agents

2026-07-28

AI Summary

This work addresses a novel security threat wherein large language model (LLM) agents can be induced to perform malicious or unauthorized actions through Model Context Protocol (MCP) tool invocations. To mitigate this risk, the paper proposes MTGuard, a framework that introduces, for the first time, a lifecycle-aware static-dynamic collaborative analysis mechanism, overcoming the limitations of conventional approaches that rely solely on static analysis. MTGuard integrates static inspection of prompts and outputs with dynamic runtime behavior monitoring to provide end-to-end security protection for MCP tool usage. Experimental results demonstrate that MTGuard effectively suppresses diverse harmful tool-use behaviors across multiple LLM agents while preserving original performance on benign tasks, thereby significantly enhancing the robustness and efficacy of defense mechanisms.

Abstract

The rapid development of large language model (LLM) agents has enabled their broad adoption across diverse real-world tasks. To standardize interactions between LLM agents and external environments, Model Context Protocol (MCP) tools have emerged as a de facto standard and have been widely integrated into these systems. However, the use of MCP tools also introduces new safety risks, as LLM agents can be induced to perform malicious or unauthorized actions. Although prior work has proposed defenses for securing tool use in LLM agents, most methods rely on static analysis, i.e., inspecting prompts and generated outputs, which limits the defense effectiveness and robustness. To address these limitations, we propose MTGuard, a hybrid analysis-based defense framework designed to safeguard the use of MCP tools in LLM agents by leveraging lifecycle-aware static-dynamic co-analysis. Extensive evaluation demonstrates that MTGuard effectively mitigates multiple categories of harmful tool use across different LLM agents while maintaining performance on benign user tasks.

Problem

• LLM agents
• MCP tools
• security risks
• tool use safety
• malicious actions

Innovation

• hybrid analysis
• MCP tool security
• LLM agent safety
• static-dynamic co-analysis
• MTGuard