EXECUTIVE SUMMARY
- MCP adoption is accelerating, but security has not kept pace. The protocol layer introduces a new attack surface where attackers only need to control what the model reads, not exploit code.
- MCPThreatHive builds on MCP-38, turning a taxonomy of 38 protocol-level threats into continuous, automated threat intelligence through a four-stage pipeline covering intelligence gathering, AI threat analysis, knowledge graph construction, and risk prioritization.
- Real-world validation confirmed end-to-end attack chain reconstruction. Using the GitHub MCP prompt injection incident, MCPThreatHive identified Indirect Prompt Injection (MCP-20), mapped it to Data Exfiltration (MCP-24), and reconstructed the full multi-tool attack chain.
- MCPThreatHive is released as open-source, enabling continuous MCP threat intelligence, cross-framework threat mapping against STRIDE and OWASP, and risk prioritization for agentic systems.
The Security Gap in Agentic AI
AI systems are no longer just generating responses.
They are planning, acting, and interacting with tools, data, and external environments — often autonomously.
At the center of this shift is the Model Context Protocol (MCP), now widely adopted as the standard for connecting LLM-based systems to external tools and services.
But while MCP adoption is accelerating,
security has not caught up.
The Protocol Layer: A New Attack Surface
MCP fundamentally changes how systems behave.
Tool selection and execution are no longer hardcoded —
they are determined by natural-language descriptions at inference time.
This creates a new class of threats:
- Tool description poisoning
- Indirect prompt injection
- Multi-step attack chains
- Semantic manipulation of decisions
In this model, attackers don’t need to exploit code.
They only need to control what the model reads.
From MCP-38 to MCPThreatHive
We previously introduced MCP-38, a taxonomy of 38 protocol-level threats.
MCPThreatHive builds on this foundation —
turning taxonomy into actionable, continuous threat intelligence.
How MCPThreatHive Works
MCPThreatHive operates as a four-stage pipeline:
Stage 1: Intelligence Gathering
Aggregates data from CVEs, GitHub advisories, research sources
Stage 2: AI Threat Analysis
Classifies threats against MCP-38, STRIDE, and OWASP frameworks
Stage 3: Knowledge Graph
Models relationships and multi-step attack chains
Stage 4: Risk Planning
Generates prioritized risk insights and mitigation strategies
Real-World Validation
Using the GitHub MCP prompt injection incident, MCPThreatHive:
- Identified Indirect Prompt Injection (MCP-20)
- Mapped the attack to Data Exfiltration (MCP-24)
- Reconstructed the full multi-tool attack chain
What’s Next
MCPThreatHive is released as an open-source platform to support:
- Continuous MCP threat intelligence
- Cross-framework threat mapping
- Risk prioritization for agentic systems
GitHub: https://github.com/VulcanLab/MCPThreatHive
Final Thought
If MCP is the connective layer of agentic AI,
then MCPThreatHive is the visibility layer needed to secure it.
Read the full paper on arXiv: https://arxiv.org/abs/2604.13849
