AI RESEARCH
MCPShield: Content-Aware Attack Detection for LLM Agent Tool-Call Traffic
arXiv CS.AI
•
ArXi:2605.11053v1 Announce Type: cross The Model Context Protocol (MCP) has become a widely adopted interface for LLM agents to invoke external tools, yet learned monitoring of MCP tool-call traffic remains underexplored. In this article, MCPShield is presented as an attack detection framework for MCP tool-call traffic that encodes each agent session as a graph (tool calls as nodes, sequential and data-flow links as edges), enriches nodes with sentence-embedding features over arguments and responses, and classifies sessions as benign or attacked.