ZTE

ZTE Communications ›› 2025, Vol. 23 ›› Issue (3): 27-37.DOI: 10.12142/ZTECOM.202503004

• Special Topic • Previous Articles     Next Articles

From Function Calls to MCPs for Securing AI Agent Systems: Architecture, Challenges and Countermeasures

WANG Wei1, LI Shaofeng2, DONG Tian1, MENG Yan1, ZHU Haojin1()   

  1. 1.Shanghai Jiao Tong University, Shanghai 200240, China
    2.Southeast University, Nanjing 211189, China
  • Received:2025-07-25 Online:2025-09-11 Published:2025-09-11
  • About author:WANG Wei received her BA degree in French with a minor in information engineering from Shanghai Jiao Tong University, China in 2024. She is currently pursuing her ME degree in electronic information at Shanghai Jiao Tong University. Her research focuses on the security of large language models and AI agent systems.
    LI Shaofeng is an associate professor at the School of Computer Science and Engineering, Southeast University, China. He received his PhD degree from the Department of Computer Science and Engineering at Shanghai Jiao Tong University, China in 2022. From 2022 to 2024, he worked as a postdoctoral researcher at Peng Cheng Laboratory, China. His research interests include artificial intelligence and system security. He received the Distinguished Paper Award at USENIX Security 2024 and the Best Paper Award Runner-up at ACM CCS 2021.
    DONG Tian received his PhD degree at computer science and technology from Shanghai Jiao Tong University, China in 2025. He received his MS degree in electronic and communication engineering from Shanghai Jiao Tong University in 2022. His research interests include the intersection of security, privacy, and machine learning.
    MENG Yan is an assistant professor in Shanghai Jiao Tong University, China. He received his PhD degree in computer science and technology from Shanghai Jiao Tong University in 2021. He received his BS degree in electronic and information engineering from Huazhong University of Science and Technology, China in 2016. His research interests include wireless network security and IoT security. He received the 2022 ACM China Doctoral Dissertation Award and the Young Elite Scientists Sponsorship Program by CAST.
    ZHU Haojin (zhu-hj@cs.sjtu.edu.cn) received his BS degree from Wuhan University, China in 2002, MS degree from Shanghai Jiao Tong University, China in 2005 (both in computer science), and PhD degree in electrical and computer engineering from the University of Waterloo, Canada in 2009. He is currently a professor and the Vice Dean of the School of Computer Science at Shanghai Jiao Tong University. His current research interests include network security and privacy enhancing technologies. He received a number of awards including SIGSOFT Distinguished Paper of ESEC/FSE (2023), ACM CCS Best Paper Runner-Ups Award (2021). He is now an editor of IEEE Transactions on Wireless Communications and ACM Transactions on Privacy and Security. He is also a program committee member for top conferences such as USENIX Security, ACM CCS, NDSS, and IEEE INFOCOM.
  • Supported by:
    the National Natural Science Foundation of China(62325207)

RichHTML

PDF

Abstract:

With the widespread deployment of large language models (LLMs) in complex and multimodal scenarios, there is a growing demand for secure and standardized integration of external tools and data sources. The Model Context Protocol (MCP), proposed by Anthropic in late 2024, has emerged as a promising framework. Designed to standardize the interaction between LLMs and their external environments, it serves as a “USB-C interface for AI”. While MCP has been rapidly adopted in the industry, systematic academic studies on its security implications remain scarce. This paper presents a comprehensive review of MCP from a security perspective. We begin by analyzing the architecture and workflow of MCP and identify potential security vulnerabilities across key stages including input processing, decision-making, client invocation, server response, and response generation. We then categorize and assess existing defense mechanisms. In addition, we design a real-world attack experiment to demonstrate the feasibility of tool description injection within an actual MCP environment. Based on the experimental results, we further highlight underexplored threat surfaces and propose future directions for securing AI agent systems powered by MCP. This paper aims to provide a structured reference framework for researchers and developers seeking to balance functionality and security in MCP-based systems.

Key words: Model Context Protocol (MCP), security risks, agent systems