Trust Consensus for Securing MCP Selection in Educational Ecosystems
Faculty Mentor Information
Dr. Gaby Dagher, Boise State University; and Dr. Jun Zhuang, Boise State University
Presentation Date
7-15-2026
Abstract
The Model Context Protocol (MCP) is the foundation for agentic operations, allowing an agent to communicate with an application or API. Typically, an MCP server serves a specific purpose and may communicate with a multitude of tools to automate user workflows. Since Large Language Models (LLMs) are the backbone of this protocol, the need for security within this interface expands dramatically. Currently, agents fall short against several attacks, notably prompt injection and tool poisoning. Some MCP defenses will incorporate pattern matching, runtime defense, or a mix of several strategies. Since an adversary can embed a malicious instruction in a tool’s description or server metadata, which may not resemble a pattern, an agent can fall victim to such attacks, potentially compromising user data. In this paper, we outline our defensive protocol, TrustGuard-MCP, which can detect a broad range of malicious MCP attacks. This protocol examines MCP server responses and assesses the server’s intent using an LLM's judgment. We incorporate multiple LLMs into the judgment process to deliver a holistic view of an MCP server’s safety.
Trust Consensus for Securing MCP Selection in Educational Ecosystems
The Model Context Protocol (MCP) is the foundation for agentic operations, allowing an agent to communicate with an application or API. Typically, an MCP server serves a specific purpose and may communicate with a multitude of tools to automate user workflows. Since Large Language Models (LLMs) are the backbone of this protocol, the need for security within this interface expands dramatically. Currently, agents fall short against several attacks, notably prompt injection and tool poisoning. Some MCP defenses will incorporate pattern matching, runtime defense, or a mix of several strategies. Since an adversary can embed a malicious instruction in a tool’s description or server metadata, which may not resemble a pattern, an agent can fall victim to such attacks, potentially compromising user data. In this paper, we outline our defensive protocol, TrustGuard-MCP, which can detect a broad range of malicious MCP attacks. This protocol examines MCP server responses and assesses the server’s intent using an LLM's judgment. We incorporate multiple LLMs into the judgment process to deliver a holistic view of an MCP server’s safety.