🤖 AI Summary
This work addresses the security risks in existing Model Context Protocol (MCP) and Agent-to-Agent (A2A) frameworks stemming from the absence of verifiable AI agent identities, which undermines secure authorization and delegation. To resolve this, we propose a cross-protocol verifiable delegation mechanism spanning MCP, A2A, and HTTP, built upon a novel construct called Invocation-Bound Capability Tokens (IBCTs). IBCTs unify public key binding, holder-of-key attenuation, chained Datalog policies, multi-protocol transport binding, and execution provenance into a single framework. The design supports both compact JWT serialization and Biscuit-style policy encoding, with interoperable implementations in Python and Rust. Experimental evaluation demonstrates that our approach incurs only 0.049 ms overhead in Rust, increases end-to-end latency by just 0.086%, and achieves a 100% interception rate across 600 adversarial attacks—including two attack classes undetectable by conventional methods.
📝 Abstract
AI agents increasingly call tools via the Model Context Protocol (MCP) and delegate to other agents via Agent-to-Agent (A2A), yet neither protocol verifies agent identity. A scan of approximately 2,000 MCP servers found all lacked authentication. In our survey, we did not identify a prior implemented protocol that jointly combines public-key verifiable delegation, holder-side attenuation, expressive chained policy, transport bindings across MCP/A2A/HTTP, and provenance-oriented completion records. We introduce Invocation-Bound Capability Tokens (IBCTs), a primitive that fuses identity, attenuated authorization, and provenance binding into a single append-only token chain. IBCTs operate in two wire formats: compact mode (a signed JWT for single-hop cases) and chained mode (a Biscuit token with Datalog policies for multi-hop delegation). We provide reference implementations in Python and Rust with full cross-language interoperability. Compact mode verification takes 0.049ms (Rust) and 0.189ms (Python), with 0.22ms overhead over no-auth in real MCP-over-HTTP deployment. In a real multi-agent deployment with Gemini 2.5 Flash, AIP adds 2.35ms of overhead (0.086% of total end-to-end latency). Adversarial evaluation across 600 attack attempts shows 100% rejection rate, with two attack categories (delegation depth violation and audit evasion through empty context) uniquely caught by AIP's chained delegation model that neither unsigned nor plain JWT deployments detect.