Model Context Protocol

MCP — an open protocol (Anthropic, 2024) standardising how LLM applications connect to external tools and data sources.

Discussed in:

Backlinks

ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems line 27
Augmented Language Models - A Survey line 29
Augmented Language Models - A Survey line 19
Survey Of AI Agent Protocols line 27
Survey Of AI Agent Protocols line 26
Survey Of AI Agent Protocols line 18
Toolformer line 28
Toolformer line 22
Tool Use line 6
JSON-RPC line 7
Survey Of Agent Interoperability Protocols line 28
Survey Of Agent Interoperability Protocols line 18
Beyond Self-Talk - Communication-Centric Survey Of LLM Multi-Agent Systems line 23
A Scalable Communication Protocol for Networks of LLMs line 32
KQML as an Agent Communication Language line 34
concept-map line 119
concept-map line 30
concept-map line 28
SoK The Attack Surface of Agentic AI line 37
SoK The Attack Surface of Agentic AI line 26
Agent Network Protocol line 12
Principled Design Of The Modern Web Architecture line 27
Principled Design Of The Modern Web Architecture line 19
Multi-Agent Collaboration Mechanisms - Survey of LLMs line 23
AutoGen - Multi-Agent Conversation Framework line 22
Agent-to-Agent Protocol line 13
MalTool Malicious Tool Attacks line 26
MalTool Malicious Tool Attacks line 18
Inter-Agent Trust Models - A Comparative Study line 22
AI Agents Under Threat line 26
MCP Landscape Security Threats And Future Research Directions line 31
MCP Landscape Security Threats And Future Research Directions line 19

Linked Pages

Agent Network Protocol

ANP — protocol stack for multi-agent networks.

Discussed in:

Agent-to-Agent Protocol

A2A — protocol for inter-agent communication among autonomous LLM agents.

Discussed in:

LLM Agents

Large-language-model-powered agents: natural-language coordination, tool use, multi-agent orchestration.

Surveys & frameworks

Protocols & communication

Failures & threats

Lineage

MalTool Malicious Tool Attacks

MalTool: Malicious Tool Attacks on LLM Agents

Reference: Hu, Jia, Li, Song, Gong (2026). arXiv:2602.12194 (Duke, UC Berkeley). Source file: 2602.12194v2.pdf. URL

Summary

This paper presents the first systematic study of code-level malicious tool attacks on LLM agent ecosystems (MCP, Skills, mcp.so, skillsmp). Whereas prior work focused on crafting misleading tool names and descriptions, the authors show that genuinely harmful behaviour must be embedded in a tool’s implementation. They propose a CIA (confidentiality/integrity/availability) taxonomy of 12 concrete malicious behaviours (data exfiltration, credential abuse, data poisoning, file deletion, RCE downloading, CPU/GPU hijacking, DoS).

They build MalTool, a coding-LLM framework that iteratively synthesizes standalone and Trojan malicious tools using a behaviour-specific system prompt, diversity guidance, and an execution-based verifier. The result: 1,200 standalone malicious tools and 5,287 real-world tools with injected malicious behaviours. Detection methods (VirusTotal, Cisco MCP Scanner, MCPScan) perform poorly, motivating new defences.

Key Ideas

CIA taxonomy of malicious tool behaviours in agent settings.
Automatic generation pipeline: system prompt + coding LLM + execution-based verifier.
Trojan construction by embedding malicious logic in benign tool code.
Existing malware and MCP-specific scanners fail on both false-positives and false-negatives.
Dataset released for benign tools only to minimize misuse.

Connections

Conceptual Contribution

Claim: Truly harmful behaviour in LLM Agents ecosystems lives in tool implementations, not in their descriptions; prior description-level red-teaming misses the dominant attack class, and current scanners miss it too.
Mechanism: Introduces a CIA taxonomy of 12 malicious behaviours; builds MalTool, a coding-LLM pipeline (behaviour-specific system prompt + diversity guidance + execution-based verifier) that produces standalone and Trojan tools; benchmarks VirusTotal, Cisco MCP Scanner, MCPScan and shows poor detection.
Concepts introduced/used: Tool Use, Model Context Protocol, Trojan Tools, Prompt Injection, Agent Security, LLM Agents, Distributed Security
Stance: empirical
Relates to: Deepens the tool/MCP threat surface catalogued in AI Agents Under Threat and Survey Of Agent Interoperability Protocols; motivates language-based defences akin to A Language-Based Approach To Prevent DDoS and capability isolation of Security Kernel Lambda Calculus.

Principled Design of the Modern Web Architecture

Reference: Fielding & Taylor (2000). ICSE 2000. Source file: 337180.337228.pdf. URL

Summary

Fielding and Taylor introduce the Representational State Transfer (REST) architectural style as the abstract model that guided the redesign of HTTP/1.1 and URIs. REST is presented as a coordinated set of architectural constraints (client-server, statelessness, cacheability, uniform interface, layered system, code-on-demand) chosen to meet the needs of an internet-scale distributed hypermedia system.

The paper defines REST’s data elements (resource, representation, metadata, control data), connectors (client, server, cache, resolver, tunnel), and components (origin server, gateway, proxy, user agent), and uses multiple architectural views (process, data, connector) to illustrate how they combine. It then evaluates how well HTTP/1.1 and related Web standards conform to REST, using the style to diagnose architectural mismatches (e.g., cookies, embedded frames).

Key Ideas

REST as an architectural style (set of constraints), not an architecture.
Resources are conceptual, addressed by URIs; representations are transferred.
Statelessness and caching for scalability; uniform interface for generality.
Intermediaries (proxies, gateways) enabled by layered connectors.
Mismatches (e.g., cookies, HTML frames) as REST-style violations.

Connections

Conceptual Contribution

Claim: Internet-scale distributed hypermedia requires a disciplined architectural style - REST - derived from specific constraints rather than any particular implementation.
Mechanism: Decomposes architectures into data elements, connectors, and components; derives REST by incrementally adding constraints (client-server, stateless, cache, uniform interface, layered, code-on-demand); evaluates HTTP/1.1, URIs, cookies, frames against the style.
Concepts introduced/used: REST, Uniform Interface, Statelessness, Layered Systems, Resources, Representations, Architectural Styles, Hypermedia
Stance: foundational
Relates to: Provides the architectural substrate for REST-native agent protocols ACP, Agent-to-Agent Protocol and JSON-RPC Model Context Protocol covered in Survey Of Agent Interoperability Protocols; its uniform-interface constraint contrasts with the performative-rich messaging of KQML/FIPA-ACL.

A Survey of Agent Interoperability Protocols: MCP, ACP, A2A, and ANP

Reference: Ehtesham, Singh, Gupta, Kumar (2025). arXiv:2505.02279. Source file: 2505.02279v1.pdf. URL

Summary

This survey examines four emerging agent communication protocols targeting different interoperability tiers: the Model Context Protocol (MCP) for JSON-RPC tool invocation and context delivery; the Agent Communication Protocol (ACP) for REST-native multi-part performative messaging; the Agent-to-Agent Protocol (A2A) for peer-to-peer Agent-Card-based task outsourcing; and the Agent Network Protocol (ANP) for decentralized discovery using DIDs and JSON-LD.

The authors contrast architectures, discovery mechanisms, security models, and communication patterns, then recommend a phased adoption roadmap (MCP for tool access, then ACP for messaging, A2A for collaborative execution, ANP for open marketplaces). A timeline traces ancestry from KQML (1993) and FIPA-ACL (2000) through RAG, ReAct, function-calling up to modern agent protocols.

Key Ideas

Phased adoption roadmap: MCP -> ACP -> A2A -> ANP.
MCP core primitives: Tools, Resources, Prompts, Sampling under JSON-RPC 2.0.
A2A introduces Agent Cards, Tasks, Artifacts for enterprise-scale delegation.
ANP uses DIDs and JSON-LD for decentralized, internet-scale agent discovery.
Security threats tabulated across creation/operation/update lifecycle phases.

Connections

Conceptual Contribution

Claim: Modern agent interoperability is best understood as a four-tier stack (MCP for tools, ACP for messaging, A2A for delegation, ANP for open discovery) and should be adopted in that phased order.
Mechanism: Structured comparison of architectures, discovery, security, and message patterns; historical timeline rooting each protocol in KQML/FIPA-ACL ancestry; lifecycle threat table.
Concepts introduced/used: Model Context Protocol, Agent-to-Agent Protocol, Agent Network Protocol, Agent Communication Protocol, KQML, FIPA-ACL, Agent Cards, Decentralized Identifiers, JSON-RPC, Tool Use, LLM Agents
Stance: survey
Relates to: Complements the broader Survey Of AI Agent Protocols with a narrower, adoption-oriented roadmap. Its security-threat lifecycle connects directly to AI Agents Under Threat and MalTool Malicious Tool Attacks.

A Survey of AI Agent Protocols

Reference: Yang, Chai, Song, Qi, Wen, Li, Liao, Hu, Lin, Chang, Liu, Wen, Yu, Zhang (2025). arXiv:2504.16736. Source file: 2504.16736v2.pdf. URL

Summary

This survey offers the first comprehensive classification and analysis of emerging AI agent protocols for LLM-based agents. The authors propose a two-dimensional taxonomy: (object orientation) context-oriented vs inter-agent protocols, and (application scenario) general-purpose vs domain-specific, covering MCP, A2A, ANP, ACP, Agora, LMOS, agents.json, LOKA, PXP, CrowdES, and others.

The paper then evaluates these protocols across efficiency, scalability, security, reliability, extensibility, operability, and interoperability, and sketches a forward-looking agenda: protocols should evolve from static to adaptive, from rules to ecosystems, and from mere communication to collective intelligence infrastructure.

Key Ideas

Two-dimensional taxonomy of agent protocols (object orientation x application scenario).
MCP as a universal context-oriented protocol with Host/Client/Server/Resource roles.
Inter-agent layer splits into general-purpose (A2A, ANP, AITP, ACP, Agora) and domain-specific (robot, human-computer, system).
Evaluation across 7 axes; case studies of MCP, A2A, ANP, Agora.
Next-generation protocols need adaptability, privacy preservation, group interaction.

Connections

Conceptual Contribution

Claim: The zoo of emerging LLM Agents protocols can be organised along two orthogonal axes (context-oriented vs inter-agent; general-purpose vs domain-specific), and evaluated on a shared seven-axis rubric.
Mechanism: Builds a taxonomy, then systematically compares Model Context Protocol, Agent-to-Agent Protocol, Agent Network Protocol, ACP, Agora, LMOS, agents.json, LOKA, PXP, CrowdES against efficiency, scalability, security, reliability, extensibility, operability, interoperability, with case studies.
Concepts introduced/used: Model Context Protocol, Agent-to-Agent Protocol, Agent Network Protocol, Agent Communication Languages, LLM Agents, Multi-Agent Systems, Interoperability, Agent Discovery
Stance: survey
Relates to: Shares its subject with Survey Of Agent Interoperability Protocols but takes a broader taxonomic view; its forward-looking “protocols as ecosystems” framing converges with Levels Of Social Orchestration and motivates coordination layers like Ripple Effect Protocol. Historical continuity with KQML and FIPA-ACL is implicit.

Model Context Protocol

Related

Backlinks