MCP Security · Defense-Coverage Benchmark
A vendor-neutral benchmark. Each tool is driven through its real code against 37 MCP attack vectors, crosswalked to the NIST AI RMF and the OWASP LLM & Agentic Top 10. Results are measured, with matched benign controls — not self-reported.
| Tool | Class | CorpusRobustCoverage | Capability | ● enforce | ◐ detect | none | False pos. |
|---|---|---|---|---|---|---|---|
| mcp-bastion | runtime-proxy | 66% (24.6/37) | 74% (27.5) | 23 | 9 | 5 | 0 / 66 |
| mcp-firewall | runtime-proxy | 8% (3.0/37) | 11% (4.0) | 4 | 0 | 33 | 0 / 66 |
| pipelock | egress-firewall | 4% (1.3/37) | 7% (2.5) | 1 | 3 | 33 | 0 / 66 |
| null-baseline | none | 0% (0.0/37) | 0% (0.0) | 0 | 0 | 37 | 0 / 66 |
Weighting: enforce = 1.0, detect = 0.5, none = 0, over 37 vectors. CorpusRobustCoverage (headline) is the mean across all fixtures of a vector, including evasion variants; Capability is best-case (detects ≥ 1 fixture). Where the two diverge, the tool is brittle to evasion. A vector counts only if the tool flags the attack and stays clean on the matched benign control (else it's a false positive); a false positive on any benign variant scores that vector 0. Zero false positives across all tools.
Scope of this number: CorpusRobustCoverage is a descriptive coverage measure over a fixed, non-exhaustive corpus — not a procurement or substitutability ranking. A higher score does not mean a tool better closes your deployment's gap, and tools at different architectural layers (e.g. a runtime proxy vs. an egress firewall) are not substitutable. Read the per-vector matrix and the defense-in-depth view for decisions. Scoping clarified and the original metric fix credited to M. Brighindi; a decision-indexed RequiredGapClosure metric is planned — see CHANGELOG-scoring.
| Vector | Layer | mcp-bastion | mcp-firewall | pipelock | null-baseline |
|---|---|---|---|---|---|
| Tool poisoning | tool | ◐ | |||
| Tool name collision / shadowing | client | ◐ | |||
| Rug pull / dynamic capability mutation | tool | ● | |||
| Out-of-scope parameter injection | server | ● | |||
| Prompt injection via tool results | tool | ◐ | ◐ | ||
| Indirect / retrieval injection | tool | ● | ● | ◐ | |
| Cross-tool data exfiltration / confused deputy | client | ● | ● | ● | |
| Tool-transfer / cross-server chaining | host-orchestration | ● | |||
| False-error escalation | tool | ◐ | |||
| Package / name squatting in registry | registry-supply-chain | ||||
| Supply-chain poisoning (unverified provenance) | registry-supply-chain | ||||
| Configuration drift | server | ◐ | |||
| Sandbox escape | server | ||||
| Schema / validation bypass | server | ● | |||
| Man-in-the-middle (transport) | transport | ◐ | |||
| DNS rebinding (local servers) | transport | ● | |||
| Server impersonation / identity spoofing | registry-supply-chain | ● | |||
| Excessive permission / privilege escalation | host-orchestration | ◐ | |||
| Credential / token theft via passthrough | host-orchestration | ● | ● | ||
| Consent fatigue / over-broad grants | client | ||||
| Command injection in tool execution | server | ● | |||
| System-prompt / context leakage via tools | client | ◐ | ◐ | ||
| Mid-session tool injection (MSTI) | client | ● | |||
| Multi-tool split poisoning (ShareLock) | tool | ◐ | |||
| Header/body routing desync (HeaderMismatch) | transport | ● | |||
| MRTR requestState forgery / replay | server | ● | |||
| List-result cache poisoning / stale-cache defense suppression | client | ● | |||
| MRTR in-band input phishing / sampling injection | client | ● | |||
| Task authorization bypass | server | ● | |||
| MCP Apps sandbox non-conformance | host-orchestration | ||||
| Roots deprecation: no enforced filesystem boundary | host-orchestration | ● | ● | ||
| Transport / revision downgrade | transport | ● | |||
| Delegated-token audience confusion (lateral misroute or passthrough) | host-orchestration | ● | |||
| Delegation subject mixing (one request, several users) | host-orchestration | ● | |||
| Stale or over-long delegate token relayed | host-orchestration | ● | |||
| Delegation chain laundering | host-orchestration | ● | |||
| Delegate token signature forgery | server | ● |
Defense-in-depth: the tools cover different layers; 32 of 37 vectors are covered by at least one tool and 5 by none (registry/supply-chain, OS-isolation, and semantic vectors that lie outside a runtime proxy's reach). No single proxy is sufficient.
| Attack | Encoding | mcp-bastion | mcp-firewall | pipelock | null-baseline |
|---|---|---|---|---|---|
| header-body-desync | base64-sentinel | ● | |||
| response-injection | homoglyph substitution | ◐ | ◐ | ||
| response-injection | base64-wrapped payload | ◐ | ◐ | ||
| tool-poisoning | zero-width / bidi-control characters | ◐ |
Robustness (evasion fixtures detected): mcp-bastion 4/4 · mcp-firewall 0/4 · pipelock 2/4 · null-baseline 0/4. The tools are robust to different obfuscations — no single tool survives all of them.
Every attack vector is crosswalked to the frameworks security and compliance teams govern by. NIST AI RMF is a U.S. federal framework (NIST, Dept. of Commerce); OWASP is an international open standard; STRIDE is the classic threat-modeling taxonomy.
| Vector | Layer | STRIDE | NIST AI RMF | OWASP LLM 2025 | OWASP Agentic 2026 | NSA guidance | ||
|---|---|---|---|---|---|---|---|---|
| Tool poisoning | tool | Tampering/ElevationOfPrivilege | MAP, MEASURE, MANAGE | LLM01, LLM06 | ASI01, ASI02 | RT, AUTH | Art.15(5) | A.6.2.6, A.4.4, A.10.3 |
| Tool name collision / shadowing | client | Spoofing/Tampering | MAP, MANAGE | LLM01, LLM03 | ASI01, ASI04 | AUTH, RT | Art.15(5) | A.6.2.6, A.4.4, A.10.3 |
| Rug pull / dynamic capability mutation | tool | Tampering | MEASURE, MANAGE | LLM03, LLM06 | ASI04 | AUTH, RT | Art.15(5), Art.14, Art.55(1)(d), Art.72 | A.6.2.6, A.4.4, A.10.3 |
| Out-of-scope parameter injection | server | Tampering/ElevationOfPrivilege | MEASURE, MANAGE | LLM05, LLM06 | ASI02 | RT, AUTH | Art.15(5), Art.55(1)(d) | A.6.2.6, A.6.2.4, A.9.2 |
| Prompt injection via tool results | tool | Tampering/ElevationOfPrivilege | MEASURE, MANAGE | LLM01, LLM05 | ASI01 | RT | Art.15(5) | A.6.2.6, A.7.5, A.10.3 |
| Indirect / retrieval injection | tool | Tampering | MEASURE, MANAGE | LLM01, LLM08 | ASI01 | RT | Art.15(5), Art.55(1)(d) | A.6.2.6, A.7.5 |
| Cross-tool data exfiltration / confused deputy | client | InformationDisclosure/ElevationOfPrivilege | MAP, MEASURE, MANAGE | LLM02, LLM06 | ASI02, ASI03 | RT, SEG | Art.15(5), Art.73 | A.6.2.6, A.8.4 |
| Tool-transfer / cross-server chaining | host-orchestration | ElevationOfPrivilege | MAP, MANAGE | LLM06 | ASI02, ASI03 | AUTH, SEG, RT | Art.15(5), Art.73 | A.6.2.6, A.10.3, A.8.4 |
| False-error escalation | tool | ElevationOfPrivilege/DenialOfService | MEASURE, MANAGE | LLM01, LLM06 | ASI01, ASI02 | RT, LOG | Art.15(5), Art.12, Art.14 | A.6.2.6, A.6.2.8, A.10.3 |
| Package / name squatting in registry | registry-supply-chain | Spoofing | GOVERN, MAP | LLM03 | ASI04 | AUTH | Art.15(5), Art.55(1)(d) | A.6.2.6, A.10.3 |
| Supply-chain poisoning (unverified provenance) | registry-supply-chain | Tampering/Spoofing | GOVERN, MAP, MANAGE | LLM03, LLM04 | ASI04 | AUTH | Art.15(5), Art.55(1)(d), Art.73 | A.6.2.6, A.10.3, A.8.4 |
| Configuration drift | server | Tampering | GOVERN, MEASURE, MANAGE | LLM03 | ASI04 | LOG, AUTH | Art.15(5), Art.12, Art.26, Art.55(1)(d), Art.72 | A.6.2.6, A.6.2.8, A.6.2.5 |
| Sandbox escape | server | ElevationOfPrivilege | MANAGE, MEASURE | LLM06 | ASI02, ASI03, ASI05 | RT | Art.15(5), Art.55(1)(d), Art.73 | A.6.2.6, A.6.2.4, A.6.2.5, A.8.4 |
| Schema / validation bypass | server | Tampering/ElevationOfPrivilege | MEASURE, MANAGE | LLM05 | ASI02 | RT | Art.15(5), Art.55(1)(d) | A.6.2.6, A.6.2.4 |
| Man-in-the-middle (transport) | transport | Tampering/InformationDisclosure/Spoofing | MANAGE, MEASURE | LLM02 | ASI03, ASI07 | RT, AUTH | Art.15(5), Art.55(1)(d) | A.6.2.6, A.6.2.5 |
| DNS rebinding (local servers) | transport | Spoofing/ElevationOfPrivilege | MANAGE, MEASURE | LLM06 | ASI03, ASI07 | AUTH, RT | Art.15(5), Art.55(1)(d) | A.6.2.6, A.6.2.5 |
| Server impersonation / identity spoofing | registry-supply-chain | Spoofing | GOVERN, MAP, MANAGE | LLM03 | ASI03, ASI04 | AUTH | Art.15(5), Art.55(1)(d), Art.72 | A.6.2.6, A.10.3 |
| Excessive permission / privilege escalation | host-orchestration | ElevationOfPrivilege | GOVERN, MAP, MANAGE | LLM06 | ASI03 | AUTH | Art.15(5), Art.14, Art.26, Art.55(1)(d) | A.6.2.6, A.6.2.5, A.9.2 |
| Credential / token theft via passthrough | host-orchestration | InformationDisclosure/ElevationOfPrivilege | GOVERN, MANAGE | LLM02, LLM06 | ASI03 | RT, SEG, AUTH | Art.15(5), Art.55(1)(d), Art.73 | A.6.2.6, A.8.4 |
| Consent fatigue / over-broad grants | client | ElevationOfPrivilege/Repudiation | GOVERN, MANAGE | LLM06 | ASI03 | AUTH | Art.15(5), Art.14, Art.26 | A.6.2.6, A.6.2.5, A.9.2 |
| Command injection in tool execution | server | ElevationOfPrivilege/Tampering | MEASURE, MANAGE | LLM05 | ASI02, ASI05 | RT | Art.15(5), Art.55(1)(d), Art.73 | A.6.2.6, A.6.2.4, A.8.4 |
| System-prompt / context leakage via tools | client | InformationDisclosure | MEASURE, MANAGE | LLM07, LLM02 | ASI01 | RT, LOG | Art.15(5), Art.12 | A.6.2.6, A.6.2.8 |
| Mid-session tool injection (MSTI) | client | Tampering/Spoofing | MEASURE, MANAGE | LLM01, LLM06 | ASI01, ASI04 | AUTH, LOG | Art.15(5), Art.12, Art.14, Art.72 | A.6.2.6, A.6.2.8, A.4.4, A.10.3 |
| Multi-tool split poisoning (ShareLock) | tool | Tampering | MEASURE, MANAGE | LLM01, LLM03 | ASI01, ASI04 | RT, LOG | Art.15(5), Art.12, Art.55(1)(d) | A.6.2.6, A.6.2.8, A.4.4, A.10.3 |
| Header/body routing desync (HeaderMismatch) | transport | Tampering/ElevationOfPrivilege | MEASURE, MANAGE | LLM06 | ASI02, ASI03 | AUTH, RT | Art.15(5), Art.55(1)(d) | A.6.2.6, A.6.2.4 |
| MRTR requestState forgery / replay | server | Tampering/Spoofing/ElevationOfPrivilege | MEASURE, MANAGE | LLM06 | ASI03, ASI09 | AUTH, RT | Art.15(5), Art.55(1)(d), Art.73 | A.6.2.6, A.6.2.4, A.8.4 |
| List-result cache poisoning / stale-cache defense suppression | client | Tampering | MEASURE, MANAGE | LLM01, LLM03 | ASI01, ASI04, ASI06 | RT, LOG | Art.15(5), Art.12, Art.72 | A.6.2.6, A.6.2.8, A.4.4, A.10.3 |
| MRTR in-band input phishing / sampling injection | client | Spoofing/InformationDisclosure | MAP, MEASURE, MANAGE | LLM01, LLM02 | ASI01, ASI03, ASI09 | AUTH, RT | Art.15(5), Art.14 | A.6.2.6, A.10.3 |
| Task authorization bypass | server | ElevationOfPrivilege/InformationDisclosure/Spoofing | MEASURE, MANAGE | LLM02, LLM06 | ASI03 | AUTH, LOG | Art.15(5), Art.12, Art.55(1)(d) | A.6.2.6, A.6.2.8, A.6.2.4 |
| MCP Apps sandbox non-conformance | host-orchestration | Tampering/InformationDisclosure | MAP, MANAGE | LLM05, LLM02 | ASI05, ASI09 | RT | Art.15(5), Art.14, Art.26 | A.6.2.6, A.6.2.5, A.10.3 |
| Roots deprecation: no enforced filesystem boundary | host-orchestration | ElevationOfPrivilege/InformationDisclosure | MAP, MANAGE | LLM06, LLM02 | ASI02, ASI03 | SEG, AUTH | Art.15(5), Art.26, Art.55(1)(d) | A.6.2.6, A.6.2.4, A.6.2.5, A.9.2 |
| Transport / revision downgrade | transport | Tampering/Spoofing | MEASURE, MANAGE | ASI07 | AUTH, RT | Art.15(5), Art.26, Art.55(1)(d) | A.6.2.6, A.6.2.5 | |
| Delegated-token audience confusion (lateral misroute or passthrough) | host-orchestration | Spoofing/ElevationOfPrivilege | MEASURE, MANAGE | LLM06 | ASI03, ASI07 | AUTH, LOG | Art.15(5), Art.12, Art.73 | A.6.2.6, A.6.2.8, A.6.2.4, A.6.2.5, A.8.4 |
| Delegation subject mixing (one request, several users) | host-orchestration | Spoofing/ElevationOfPrivilege | MEASURE, MANAGE | LLM06 | ASI03, ASI07 | AUTH, LOG | Art.15(5), Art.12, Art.73 | A.6.2.6, A.6.2.8, A.6.2.4, A.8.4 |
| Stale or over-long delegate token relayed | host-orchestration | Spoofing/ElevationOfPrivilege | GOVERN, MEASURE, MANAGE | LLM06 | ASI03, ASI07 | AUTH, LOG | Art.15(5), Art.12 | A.6.2.6, A.6.2.8, A.6.2.4 |
| Delegation chain laundering | host-orchestration | ElevationOfPrivilege/Repudiation | GOVERN, MEASURE, MANAGE | LLM06 | ASI03, ASI07 | AUTH, LOG | Art.15(5), Art.12, Art.26 | A.6.2.6, A.6.2.8, A.6.2.5, A.9.2 |
| Delegate token signature forgery | server | Spoofing/Tampering/ElevationOfPrivilege | GOVERN, MEASURE, MANAGE | LLM06 | ASI03, ASI07 | AUTH, RT | Art.15(5), Art.55(1)(d), Art.73 | A.6.2.6, A.6.2.4, A.8.4 |
NIST AI RMF: GOVERN · MAP · MEASURE · MANAGE. OWASP LLM: LLM01 Prompt Injection · LLM02 Sensitive Info Disclosure · LLM03 Supply Chain · LLM04 Data/Model Poisoning · LLM05 Improper Output Handling · LLM06 Excessive Agency · LLM07 System Prompt Leakage · LLM08 Vector/Embedding. OWASP Agentic: ASI01 Agent Goal Hijack · ASI02 Tool Misuse · ASI03 Identity & Privilege Abuse · ASI04 Agentic Supply Chain. NSA guidance (May 2026): AUTH Authentication & Access Control · LOG Monitoring & Logging · SEG Data Classification & Segmentation · RT Runtime Controls.
Frameworks:
NIST AI RMF 1.0 (U.S. federal) ·
OWASP Top 10 for LLM Apps (2025) ·
OWASP Top 10 for Agentic Apps (2026) ·
STRIDE ·
NSA MCP Security CSI (U.S. federal — NSA AI Security Center, May 2026).
MCP security research:
SoK 2512.08290 ·
Formal framework 2604.05969 ·
STRIDE/DREAD 2603.22489 ·
MCP-DPT 2604.07551 ·
MSB 2510.15994 ·
MCPTox 2508.14925 ·
ETDI 2506.01333 ·
Trustworthy MCP Registry ·
WebMCP/MSTI 2606.06387 ·
ShareLock 2606.27027.
MCP protocol:
Specification ·
Registry.
Each adapter drives the tool's actual detection code or CLI — never a mock. A defender is scored only on what it inspects at runtime (a proxy that ignores tool results scores none there, even if its rules would match the text in isolation). Absolute totals are corpus-dependent; the per-vector matrix is the more reliable read. Scored tools run locally and deterministically; cloud-model tools are observed, not scored. Full methodology and prior-art positioning are in the repository.