VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers

2026-05-20

AI Summary

This work addresses a critical security vulnerability in Model-Context-Protocol (MCP) servers, where flaws in tool handler implementations enable attackers to exploit natural language inputs for remote code execution via taint propagation. Existing detection approaches struggle with complex parameter structures and multi-step taint flows. To overcome these challenges, the authors propose the first end-to-end automated auditing framework that combines static analysis—using anchor queries to precisely identify tool handlers and reconstruct vulnerable call chains—with a feedback-driven dual-mutation prompt evolution mechanism to correct tool selection drift and enhance parameter penetration depth. Evaluated across 39,884 open-source MCP repositories, the framework uncovered 106 zero-day vulnerabilities, all validated through end-to-end exploitation; 67 of these have been assigned CVE identifiers and responsibly disclosed.

Abstract

Model Context Protocol (MCP) has emerged as a standard interface for connecting LLM agents to external tools. Because MCP servers expose privileged operations such as shell execution, network access, and file-system manipulation to agent-driven invocation, implementation flaws in tool handlers can create a direct path from natural-language input to security-sensitive sinks, potentially granting attackers remote code execution or full system compromise. Existing approaches either produce unconfirmed static alerts without dynamic validation, or rely on fixed template libraries that lack code-level guidance and fail to trigger vulnerabilities requiring specific parameter shapes or multi-step taint paths. In this paper, we present VIPER-MCP, the first end-to-end automated vulnerability auditing framework for MCP servers that not only detects taint-style vulnerabilities but also dynamically confirms their exploitability by producing concrete proof-of-concept prompts. VIPER-MCP introduces two novel techniques: (1) an anchor-query pass in a two-pass static analysis strategy that augments standard taint alerts with function-level structural context, resolving file-level static artifacts to specific MCP tool handlers and producing vulnerability-anchored call chains; and (2) a feedback-driven prompt evolution mechanism that employs dual-mutator scheduling that independently corrects tool-selection drift and deepens parameter penetration, together with fitness-scored seed selection to iteratively refine natural-language prompts toward vulnerable sinks. In a large-scale scan of 39,884 real-world open-source MCP server repositories, VIPER-MCP discovered 106 0-day vulnerabilities, all of which were confirmed through end-to-end exploit traces, with 67 CVE IDs assigned to date. We responsibly disclosed all confirmed findings to the affected developers and coordinated CVE assignment where applicable.

Problem

• Model Context Protocol
• taint-style vulnerabilities
• vulnerability detection
• prompt-based exploitation
• LLM agents

Innovation

• taint analysis
• Model Context Protocol
• prompt evolution
• vulnerability exploitation
• static-dynamic hybrid analysis