AEGIS: Preventing Cross-Domain Resource Abuse in MCP
This paper introduces AEGIS, a policy enforcement component that leverages large language models to analyze and normalize diverse MCP tool invocations, enabling administrators to define fine-grained safeguards against cross-domain resource abuse while preserving ecosystem flexibility.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a world where artificial intelligence agents act as personal assistants, capable of reaching out to other computer programs to fetch data, analyze images, or manage complex tasks. To make this possible, engineers created a standard language called the Model Context Protocol, which allows these AI agents to talk to external tools in a structured way. Think of it as a universal remote control for software, letting an AI ask a database for a list of files or a map service for a location. However, just as a remote control can be used to change a channel or accidentally turn off the entire television, these AI agents can sometimes make requests that are too large or too demanding. If an agent asks for a video that is too long, a list of results that is too vast, or an image resolution that is too high, it can overwhelm the computer systems behind the scenes, causing them to slow down or stop working entirely. This is not a problem of the AI being malicious, but rather a consequence of its ability to ask for anything, combined with the fact that many of these tools lack strict limits on what they will accept.
Researchers at IBM Research have developed a new system called AEGIS to solve this specific problem of resource exhaustion. The core challenge they faced was that every tool an AI might use is different. One tool might ask for a "radius" to define a search area, while another asks for a "distance," and yet another uses "miles" or "kilometers." Furthermore, the tools handle different types of data, such as text, video, or location, and each type of data consumes computer power in a unique way. A request for a thousand text messages is easy for a computer to handle, but a request for a thousand high-definition videos could crash the system. Because the language and structure of these requests vary so wildly, it has been nearly impossible for security teams to write a single set of rules that works for all of them. Writing these rules manually for hundreds of different tools is slow, error-prone, and difficult to scale.
To overcome this, the team built AEGIS, a system that uses the reasoning power of large language models to act as a translator and a gatekeeper. Instead of trying to memorize every possible tool, the system analyzes the description of each tool an AI might use and automatically figures out what kind of data it handles and what kind of action it performs. It then takes the confusing, varied names of the parameters—like "limit," "count," or "max_results"—and translates them into a single, standard vocabulary. For example, it recognizes that asking for "fifty miles" in a location tool and "one hundred results" in a text tool are both requests for a specific volume of data that could be dangerous if left unchecked. By converting these diverse requests into a common language, the system can apply a consistent set of safety rules across the entire ecosystem.
Once the system understands the tools, it does not just guess where to set the limits; it measures them. The researchers ran a series of tests where they gradually increased the size of the requests sent to a server, watching closely to see when the system began to struggle or make mistakes. They found the exact point where the computer could still handle the load without failing and set that as the safety boundary. This process, known as benchmarking, allows the system to create a custom safety limit for every single tool it encounters, ensuring that the AI can still do its job without accidentally breaking the computer it is talking to.
The team tested this approach on a collection of nearly one thousand different tools drawn from a wide range of real-world services, including cloud computing, databases, and search engines. The system proved remarkably accurate at identifying what each tool does and categorizing the data it handles, correctly classifying the type of data and the nature of the operation in more than ninety-eight percent of cases. It also successfully identified which tools were likely to cause resource problems and normalized their parameters with high precision. When the researchers simulated a scenario where an AI agent tried to overwhelm a server by requesting an excessive number of images, the system with AEGIS in place blocked the harmful request and kept the server running smoothly, while the unprotected server crashed under the load.
This work demonstrates that it is possible to secure these complex, interconnected AI systems without sacrificing their flexibility. By using intelligent analysis to understand the intent behind a request and by measuring the actual capacity of the systems, AEGIS provides a way to protect against resource abuse that adapts to the diversity of the tools being used. The researchers note that while the system is highly effective, the task of perfectly translating every possible parameter name remains challenging, and future work will focus on expanding this protection to even more complex scenarios where multiple tools are used in sequence. For now, the system offers a practical method to ensure that as AI agents become more capable and widespread, they do not inadvertently bring the very systems they rely on to a halt.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.