🤖 AI Summary
This work addresses the absence of a systematic security framework in existing AI agent protocols—such as MCP and A2A—which undermines secure interactions across trust boundaries. We propose a six-layer protocol stack model tailored for AI agent communication and an implementation-agnostic Agent-Centric Security Model (AASM). To enforce and validate this model, we develop AgentConform, a two-stage conformance checking tool that integrates TLA+ formal modeling, a typed Protocol Intermediate Representation (IR), model checking, and runtime replay verification. For the first time, we formally define eleven security principles and introduce a mechanism for composition safety. Applying our approach to mainstream protocols reveals systemic flaws concerning credential lifecycle management, authorization enforcement, audit integrity, and compositional security; several identified vulnerabilities are already undergoing coordinated disclosure.
📝 Abstract
AI agent protocols -- including MCP, A2A, ANP, and ACP -- enable autonomous agents to discover capabilities, delegate tasks, and compose services across trust boundaries. Despite massive deployment (MCP alone has 97M+ monthly SDK downloads), no systematic security framework for these protocols exists.
We present three contributions. First, the Agent Protocol Stack, a 6-layer architectural model that defines what a complete agent protocol must specify at each layer -- analogous to ITU-T X.800 for the OSI stack. Second, the Agent-Agnostic Security Model, 11 security principles formalized as TLA+ invariants, each tagged with a property taxonomy (spec-mandated, spec-recommended, aasm-hardening, aps-completeness) that distinguishes protocol non-conformance from framework-imposed security requirements. Third, AgentConform, a two-phase conformance checker that (i)extracts normative clauses from protocol specifications into a typed Protocol~IR with explicit Protocol/Environment/Adversary action separation, (ii)compiles the IR into TLA+ models and model-checks them against AASM invariants, then (iii)replays counterexample traces against live SDK implementations to confirm findings.
We introduce the Composition Safety (CS) principle: security properties that hold for individual protocols can break when protocols are composed through shared infrastructure. We demonstrate this with formal models of five protocol composition patterns, revealing cross-protocol design gaps that individual protocol analysis cannot detect. Preliminary application to representative agent protocols reveals recurrent gaps in credential lifecycle, consent enforcement, audit completeness, and composition safety. Some findings are under coordinated disclosure; full evaluation details will be released in the complete version.