AID-H-028: MCP & Tool Client Security Hardening

Version 1.20261015 · Family — navigation only

Harden the MCP or tool client itself - the local runtime, SDK, IDE extension, CLI client, or desktop application that sends requests to remote MCP servers, stores credentials, caches server responses, and mediates user permissions. The supported baseline is MCP v2 2026-07-28: initialize/notifications/initialized and Mcp-Session-Id are absent, protocol version and client capabilities travel in required per-request metadata, optional clientInfo carries self-reported client name and version when supplied, and explicit application handles carry cross-call state.

Coverage includes:

Validating remote server authenticity before discovery or request dispatch.
Protecting locally stored credentials and tokens from extraction.
Preventing sensitive data from leaking through client-managed logs, caches, temporary files, or crash artifacts.
Preventing malicious server responses from triggering client-side code execution or unsafe rendering.
Isolating per-server request context, cache scope, credentials, and explicit application state.
Verifying client binary, plugin, and update integrity.

Release gate: pin the 2026-07-28 specification, authoritative v2 schema, official SDK v2 artifacts, and conformance fixtures. Reject any request whose declared version differs. Negative fixtures must prove handshake methods and session headers cannot create protocol state.

Scope boundary

Owns MCP and tool client or host security: remote-server trust, local credential storage, client-controlled data artifacts, response rendering, request and cache isolation, client distribution integrity, user-facing multi-round-trip input, and deprecated client sampling exceptions.

AID-H-034: AID-H-028 owns the client and host side of MCP interactions; AID-H-034 owns server transport, publication, handler authorization, output, explicit-state, task, subscription, budget, and disable enforcement. A control must be implemented at the side that owns the vulnerable state or decision.

AID-H-024: AID-H-028 hardens the selected client's connection and local behavior; AID-H-024 resolves the intended logical server, tool, version, and descriptor contract. Client hardening does not correct ambiguous or poisoned resolution.

AID-H-004.005: AID-H-028 owns MCP client and host security, including credentials, rendering, local state, and client distribution; AID-H-004.005 supplies conditional end-to-end message integrity and replay protection when the client's communication path crosses untrusted or asynchronous intermediaries. Client hardening alone does not preserve one message across a multi-hop path.

Warning

Emerging Attack Surface

MCP client-side security is an emerging and rapidly evolving attack surface.

Diverse client implementations: Desktop apps, IDE plugins, browser extensions, CLI tools, and custom local runtimes all have different privilege boundaries, local storage patterns, and sandboxing properties.
Credential exposure remains common: Many current client implementations still store API keys or tokens in plaintext configuration files or user-readable local state.
Server-to-client attack paths are practical: A malicious or compromised MCP server can return crafted content that targets the client parser, renderer, cache, or action-confirmation flow.

Sub-techniques

Threat mappings

MITRE ATLAS

AML.T0010 AI Supply Chain Compromise
AML.T0010.001 AI Supply Chain Compromise: AI Software
AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
AML.T0011 User Execution
AML.T0011.002 User Execution: Poisoned AI Agent Tool
AML.T0012 Valid Accounts
AML.T0051 LLM Prompt Injection
AML.T0053 AI Agent Tool Invocation
AML.T0054 LLM Jailbreak
AML.T0057 LLM Data Leakage
AML.T0073 Impersonation
AML.T0074 Masquerading
AML.T0077 LLM Response Rendering
AML.T0078 Drive-by Compromise
AML.T0083 Credentials from AI Agent Configuration
AML.T0084 Discover AI Agent Configuration
AML.T0085 Data from AI Services
AML.T0098 AI Agent Tool Credential Harvesting
AML.T0102 Generate Malicious Commands
AML.T0105 Escape to Host
AML.T0109 AI Supply Chain Rug Pull
AML.T0113 Steal Web Session Cookie

MAESTRO

Denial of Service (DoS) Attacks (L1)
Data Exfiltration (L2)
Compromised Framework Components (L3)
Data Leakage through Observability (L5)
Agent Identity Attack (L7)
Integration Risks (L7)
Compromised Agent Registry (L7)
Supply Chain Attacks (Cross-Layer)

OWASP LLM Top 10 2026

LLM01:2026 Prompt Injection
LLM02:2026 Sensitive Information Disclosure
LLM03:2026 Excessive Agency
LLM04:2026 Supply Chain
LLM06:2026 Unbounded Consumption

OWASP ML Top 10 2023

ML06:2023 AI Supply Chain Attacks
ML09:2023 Output Integrity Attack

OWASP Top 10 for Agentic Applications 2026

ASI01:2026 Agent Goal Hijack
ASI02:2026 Tool Misuse and Exploitation
ASI03:2026 Identity and Privilege Abuse
ASI04:2026 Agentic Supply Chain Vulnerabilities
ASI05:2026 Unexpected Code Execution (RCE)
ASI06:2026 Memory & Context Poisoning
ASI07:2026 Insecure Inter-Agent Communication
ASI09:2026 Human-Agent Trust Exploitation

NIST Adversarial Machine Learning 2025

NISTAML.036 Leaking information from user interactions
NISTAML.039 Compromising connected resources

Cisco Integrated AI Security and Safety Framework

AITech-1.2 Indirect Prompt Injection
AITech-2.1 Excessive Agency
AITech-4.2 Context Boundary Attacks
AITech-4.3 Protocol Manipulation
AITech-7.4 Token Manipulation
AITech-8.2 Data Exfiltration / Exposure
AITech-8.3 Information Disclosure
AITech-9.3 Dependency / Plugin Compromise
AITech-12.1 Tool Exploitation
AITech-13.1 Disruption of Availability
AITech-13.2 Cost Harvesting / Repurposing
AITech-16.1 Eavesdropping
AISubtech-2.1.1 Execution Approval Bypass
AISubtech-2.1.2 Capability and Permission Overreach
AISubtech-4.2.2 Session Boundary Violation
AISubtech-4.3.1 Schema Inconsistencies
AISubtech-4.3.3 Server Rebinding Attack
AISubtech-4.3.4 Replay Exploitation
AISubtech-7.4.1 Token Theft
AISubtech-8.3.3 Personally Identifiable Information Exposure
AISubtech-9.3.1 Malicious Package / Tool Injection
AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers)
AISubtech-9.3.3 Dependency Replacement / Rug Pull
AISubtech-12.1.3 Unsafe System / Browser / File Execution
AISubtech-13.1.1 Compute Exhaustion
AISubtech-13.1.2 Memory Flooding
AISubtech-13.1.3 Model Denial of Service
AISubtech-13.1.4 Application Denial of Service
AISubtech-13.2.1 Service Misuse for Cost Inflation
AISubtech-14.1.2 Insufficient Access Controls
AISubtech-16.1.1 Logging Sensitive Conversations

Google Secure AI Framework 2.0 - Risks

EDH: Excessive Data Handling
DMS: Denial of ML Service
IIC: Insecure Integrated Component
PIJ: Prompt Injection
SDD: Sensitive Data Disclosure
RA: Rogue Actions

Databricks AI Security Framework 3.0

Model 7.3: ML Supply chain vulnerabilities
Model Serving - Inference requests 9.7: Denial of Service (DoS)
Platform 12.4: Unauthorized privileged access
Agents - Core 13.1: Memory Poisoning
Agents - Core 13.2: Tool Misuse
Agents - Core 13.6: Intent Breaking & Goal Manipulation
Agents - Core 13.9: Identity Spoofing & Impersonation
Agents - Tools MCP Server 13.16: Prompt Injection
Agents - Tools MCP Server 13.19: Credential and Token Exposure
Agents - Tools MCP Server 13.24: Context Spoofing and Manipulation
Agents - Tools MCP Server 13.25: Insecure Communication
Agents - Tools MCP Client 13.26: Malicious Server Connection
Agents - Tools MCP Client 13.27: Insecure Credential Storage
Agents - Tools MCP Client 13.28: UI/UX Deception
Agents - Tools MCP Client 13.29: Insufficient Server Validation
Agents - Tools MCP Client 13.30: Client-Side Data Leakage
Agents - Tools MCP Client 13.32: Client-Side Code Execution
Agents - Tools MCP Client 13.33: Insecure Communication Handling
Agents - Tools MCP Client 13.34: Session and State Management Failures
Agents - Tools MCP Client 13.35: Update and Patch Management