MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents

1. Problem Statement

The paper addresses a critical, non-adversarial security vulnerability in Multi-Server Model Context Protocol (MCP) agents. While existing security research focuses on adversarial attacks (e.g., prompt injection, jailbreaks, malicious servers), this work identifies a structural risk inherent to faithful tool composition.

• The Core Issue: In a multi-server environment, an agent may legitimately read sensitive data (e.g., API keys, credentials) from one server (e.g., a database or config file) and write it to another (e.g., a browser, a script, or a different directory) to complete a user task.
• The Risk: This "compositional data propagation" results in credentials crossing trust boundaries without malicious intent. The agent behaves exactly as instructed, yet production credentials are inadvertently exposed in new locations outside their original access-control boundaries.
• The Gap: Current benchmarks evaluate adversarial robustness or compositional inference (synthesizing new info), but none measure the verbatim propagation of pre-existing credentials during routine, non-adversarial task execution.

2. Methodology: MCPHunt Framework

The authors introduce MCPHunt, the first controlled benchmark designed to isolate and measure non-adversarial cross-boundary credential propagation. The framework relies on three methodological pillars:

A. Canary-Based Taint Tracking

• Mechanism: Instead of using real secrets, the system injects format-authentic canary strings (e.g., sk_live_..., AKIA..., ghp_...) into the workspace (files, databases, knowledge graphs).
• Detection: Propagation is detected via objective string matching in tool-call arguments. If a canary appears in a "sink" (write operation) after being read from a "source," it is flagged as a leak. This eliminates the need for human annotation and reduces false positives.

B. Environment-Controlled Design

To ensure the detected propagation is due to task topology and not credential format artifacts, the framework runs tasks in three distinct conditions:

1. Risky: Contains format-authentic canaries.
2. Benign: Identical structure but with innocuous placeholders (no canaries). Used to verify the detector produces 0% false positives.
3. Hard-Negative: Contains human-readable, security-themed placeholders (e.g., test_key_not_for_production). This tests whether the format of the credential drives the leak or if the data flow itself is sufficient.

C. CRS Stratification (Completion-Requires-Secret)

The framework distinguishes between two types of propagation to isolate genuine safety failures:

• Task-Mandated Propagation (CRS): The prompt explicitly instructs the agent to copy data verbatim (e.g., "copy everything," "export all"). Propagation here is a deployment risk, not a model failure.
• Policy-Violating Propagation (Non-CRS): The prompt requests a derived artifact (e.g., "write a summary," "generate a report"), yet the agent includes raw credentials. This is the primary safety metric.

3. Key Contributions

1. Measurement Framework: A reusable, model-agnostic methodology using canary tracking and CRS stratification to quantify policy-violating propagation rates.
2. Risk Taxonomy: A classification of 9 risk mechanism families based on source-to-sink data flow patterns (e.g., browser_to_local, config_to_script, db_to_artifact).
3. Empirical Evidence: A large-scale evaluation across 5 models, 147 tasks, and 3,615 traces, demonstrating that propagation is a structural property of the workflow, not just a model deficiency.

4. Key Results

Propagation Rates

• Overall: Across 5 models (GPT-5.4, GPT-5.2, DeepSeek, Gemini, MiniMax), policy-violating propagation rates ranged from 11.5% to 41.3%.
• Mechanism Specificity: Propagation is highly pathway-dependent. The browser_to_local mechanism had the highest rate (74.4% for GPT-5.4), as agents struggle to filter raw HTML content. In contrast, indirect_exposure was 0%.
• Statistical Significance: Mechanism family accounted for 62% of the variance in propagation risk (pseudo-R²), whereas model identity accounted for only 32%. This proves that where data flows is a stronger predictor of risk than which model processes it.

Cross-Model Generalization

• Stronger utility (task success) does not correlate with lower propagation. For example, MiniMax-M2.7 had the highest utility (92.2%) but also the highest policy-violating propagation (41.3%).
• The Hard-Negative control confirmed that production-format credentials are not necessary for leaks; prompt-directed cross-boundary flow alone is sufficient to cause propagation.

Mitigation Analysis

• Prompt-Level Defenses: Graduated prompt mitigations (from generic reminders to detailed boundary-aware instructions) reduced policy-violating propagation by up to 97% for GPT-5.4. However, effectiveness varied significantly by model, correlating with instruction-following capabilities.
• Limitations of Prompts: Prompts were less effective against browser_to_local tasks and failed to stop task-mandated (CRS) propagation (which is structurally required by the prompt).
• Runtime Taint Guard: A simulated post-hoc guard (redacting canaries at write time) blocked 85–96% of unsafe traces across all models, suggesting that orchestration-layer enforcement is more effective and model-independent than prompt engineering.

5. Significance and Implications

• Redefining Agent Safety: The paper shifts the focus from "malicious models" to "structural side effects." It argues that even perfectly aligned models will leak credentials if the workflow topology routes data across trust boundaries without redaction logic.
• Infrastructure vs. Model: The findings suggest that relying solely on model alignment (RLHF) or prompt engineering is insufficient. Effective mitigation requires data-flow-aware orchestration (e.g., runtime taint guards) at the infrastructure level.
• Browser Risk: The browser_to_local pathway is identified as a critical vulnerability due to the lack of schema-level granularity in web content, making automated redaction difficult for current LLMs.
• Open Science: The authors released the full benchmark (code, traces, labeling pipeline) under MIT and CC BY 4.0 licenses, enabling the community to evaluate and improve agent safety.

Conclusion

MCPHunt demonstrates that multi-server MCP agents face a measurable information-flow control problem where faithful execution leads to credential leakage. The risk is primarily driven by the source-to-sink mechanism rather than the specific LLM model. While prompt mitigations can reduce risks, the paper concludes that robust security requires orchestration-layer controls (like taint tracking) to enforce data flow policies across trust boundaries.