{"id":"e662c73b-65dd-40f4-ba39-f08cc208631b","arxiv_id":"2605.21392","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"VIPER-MCP detects and exploits taint-style vulnerabilities in Model Context Protocol servers via anchor-query static analysis and feedback-driven prompt evolution, uncovering 106 zero-day vulnerabilities across 39,884 repositories with 67 CVEs assigned.","lead":"VIPER-MCP is an automated framework that scans MCP servers connecting AI agents to tools like shell commands and file access, using static analysis and evolving prompts to find and confirm security flaws. Smart generalists should read it because AI agents with real-world tool access create new attack surfaces where natural language inputs could lead to system compromise.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"No significant objection identified","rationale":"The reader's weakest assumption correctly isolates the effectiveness of the two new techniques as the least-secured link. Because the full text was not available for section-by-section inspection of false-positive rates, multi-step path coverage, or fitness-function details, no stronger technical objection can be raised. The empirical scale and CVE outcomes provide positive evidence that does not require adjustment to the UNVERDICTED verdict.","tokens_in":1854,"tokens_out":276,"duration_ms":37860,"concrete_test":"Re-run the large-scale scan on a random 5% subsample of the 39,884 repositories using only the static-analysis component (disabling prompt evolution) and measure how many of the originally reported vulnerabilities are still flagged; if the count drops by more than 30%, the dynamic confirmation step is carrying more of the claim than the static analysis alone.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim rests on the two novel techniques correctly identifying and dynamically confirming 106 exploitable taint paths across 39,884 repositories. No internal inconsistency, unsupported assumption, or clear failure mode is evident in the high-level description of the anchor-query pass or dual-mutator evolution; the reported CVE assignments and end-to-end traces constitute independent corroboration of the results.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper presents VIPER-MCP, the first end-to-end automated vulnerability auditing framework for Model Context Protocol (MCP) servers. It introduces two novel techniques—an anchor-query pass within a two-pass static analysis strategy that augments taint alerts with function-level structural context to resolve to specific MCP tool handlers, and a feedback-driven prompt evolution mechanism using dual-mutator scheduling (correcting tool-selection drift and deepening parameter penetration) with fitness-scored seed selection—to generate concrete proof-of-concept natural-language prompts. In a scan of 39,884 real-world open-source MCP server repositories, the framework identified 106 0-day vulnerabilities, all confirmed through end-to-end exploit traces, with 67 CVE IDs assigned to date; all findings were responsibly disclosed.","tokens_in":1885,"tokens_out":508,"duration_ms":50051,"significance":"If the results hold, the work is significant because it addresses security risks in the emerging MCP standard for connecting LLM agents to privileged external tools (shell, network, filesystem), where natural-language inputs can reach security-sensitive sinks. The large-scale empirical scan combined with dynamic exploit confirmation and real-world CVE assignments provides concrete evidence of practical impact beyond unvalidated static alerts. Credit is due for the responsible disclosure process and for producing reproducible end-to-end traces rather than relying solely on static analysis or fixed templates.","major_comments":[{"comment":"Abstract and the paragraphs describing the two novel techniques: the central claim that the anchor-query pass and dual-mutator prompt evolution correctly resolve taint paths to exploitable MCP tool handlers without substantial false positives or missed multi-step vulnerabilities is load-bearing for the reported 106 confirmed 0-days, yet no false-positive rate, error analysis, baseline comparison, or validation methodology for the dynamic confirmation step is supplied.","section":"Abstract"},{"comment":"Evaluation section (implied by the large-scale scan description): the claim of 106 vulnerabilities 'all of which were confirmed through end-to-end exploit traces' lacks any quantitative details on how confirmation was performed, what constitutes a valid trace, or how many candidate alerts were filtered before confirmation, undermining the ability to assess the soundness of the 106/39,884 yield.","section":"Evaluation"}],"minor_comments":[],"recommendation":"major_revision","confidential_remarks":"The manuscript fits the scope of a security journal focused on AI systems and software vulnerabilities; the citation pattern appears appropriate for an emerging protocol."},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the detailed and constructive review. The comments correctly identify areas where additional methodological transparency would strengthen the paper. We address each point below and will incorporate the suggested clarifications in the revised manuscript.","responses":[{"response":"We agree that the absence of explicit false-positive rates, error analysis, and baseline comparisons limits the ability to fully assess the precision of the anchor-query pass and dual-mutator evolution. The manuscript currently emphasizes the end-to-end discovery and confirmation results rather than intermediate validation metrics. In the revision we will add a dedicated subsection in the Evaluation section that reports: (1) a manual audit of a statistically significant sample of static alerts to estimate false-positive rate, (2) an ablation comparing the full two-pass analysis against a standard taint-analysis baseline without the anchor-query pass, and (3) a precise description of the dynamic confirmation protocol, including sandbox setup, success criteria for an exploit trace, and handling of multi-step taint paths. These additions will directly support the claim of 106 confirmed zero-days.","revision_made":"yes","referee_comment":"[Abstract] Abstract and the paragraphs describing the two novel techniques: the central claim that the anchor-query pass and dual-mutator prompt evolution correctly resolve taint paths to exploitable MCP tool handlers without substantial false positives or missed multi-step vulnerabilities is load-bearing for the reported 106 confirmed 0-days, yet no false-positive rate, error analysis, baseline comparison, or validation methodology for the dynamic confirmation step is supplied."},{"response":"The current text states that all 106 vulnerabilities were confirmed via end-to-end exploit traces but does not quantify the filtering pipeline or define a valid trace. We will revise the Evaluation section to include these details: the total number of taint alerts produced by static analysis, the number discarded at each filtering stage (e.g., non-MCP-tool handlers, unreachable sinks), the exact criteria for a successful trace (successful invocation of the vulnerable tool handler with attacker-controlled data reaching the security-sensitive sink), and the sandboxed execution environment used for confirmation. This quantitative breakdown will allow readers to evaluate the 106/39,884 yield more rigorously.","revision_made":"yes","referee_comment":"[Evaluation] Evaluation section (implied by the large-scale scan description): the claim of 106 vulnerabilities 'all of which were confirmed through end-to-end exploit traces' lacks any quantitative details on how confirmation was performed, what constitutes a valid trace, or how many candidate alerts were filtered before confirmation, undermining the ability to assess the soundness of the 106/39,884 yield."}],"tokens_in":1575,"tokens_out":561,"duration_ms":26412,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main point is that this work scanned 39,884 open-source MCP server repositories and identified 106 zero-day taint-style vulnerabilities, all confirmed with end-to-end exploit traces and leading to 67 CVE assignments so far. That level of real-world impact stands out for an emerging protocol where natural-language prompts can reach privileged operations like shell or file access. The paper brings two techniques that appear tailored for MCP. The anchor-query pass augments taint analysis by adding structural context from function calls, turning broad alerts into specific links to MCP tool handlers. The feedback-driven prompt evolution uses dual mutators—one for tool selection and one for parameter penetration—along with fitness-based seed selection to refine prompts iteratively. These allow moving beyond static warnings to actual working prompts that exploit the issues. It does a good job on scale and follow-through. Many security papers stop at alerts, but here they emphasize dynamic confirmation and disclosure. This fits the need for tools that handle the unique aspects of natural language driven tool invocation in agent systems. The softer areas are around validation. There isn't much shown on false-positive rates or a breakdown of how the techniques performed across different vulnerability types. The claims about correctly resolving taint paths rely on the described methods working well, and while the CVE results help, more internal metrics would strengthen the case. No major inconsistencies show up in the approach itself. Readers working on securing LLM agents or auditing tool servers would find this relevant. It provides both a method and a set of real examples that could inform better practices in MCP implementations. Overall, the paper shows clear thinking on the problem and engages with the practical challenges. It is worth sending to peer review for a full assessment of the methods and results.","headline":"VIPER-MCP delivers a large-scale scan of MCP servers that turned up 106 confirmed zero-days with CVE backing, using a two-pass static method plus prompt evolution to link taint paths to working exploits.","tokens_in":2398,"tokens_out":430,"would_cite":false,"duration_ms":32165,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":{"model":"grok-4.3","evidence":[{"relation":"unclear","rs_module":"IndisputableMonolith/Cost/FunctionalEquation.lean","rs_theorem":null,"paper_passage":"VIPER-MCP introduces two novel techniques: (1) an anchor-query pass in a two-pass static analysis strategy that augments standard taint alerts with function-level structural context... and (2) a feedback-driven prompt evolution mechanism that employs dual-mutator scheduling that independently corrects tool-selection drift and deepens parameter penetration"}],"headline":"VIPER-MCP taint-analysis + dual-mutator prompt evolution pipeline has no structural overlap with RS recognition-cost or forcing-chain machinery","alignment":"orthogonal","rationale":"The paper's central machinery consists of a two-pass CodeQL static taint analysis augmented by anchor queries that resolve file-level alerts to MCP tool handlers, followed by feedback-driven evolutionary prompt mutation using independent structure and parameter mutators plus fitness scoring. These techniques operate entirely within the domain of practical software-security engineering for LLM-agent tool interfaces. No component invokes, parallels, or depends on the RS recognition cost J(x), golden-ratio ladder, 8-tick periodicity, or any theorem from the Foundation, Cost, or Constants modules. The work is therefore orthogonal to the RS framework.","tokens_in":57139,"confidence":"high","tokens_out":288,"duration_ms":10753,"cache_read_input_tokens":32896,"cache_creation_input_tokens":0},"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"VIPER-MCP detects taint-style vulnerabilities in MCP servers and confirms them with evolved natural-language prompts that reach privileged sinks.","keywords":["Model Context Protocol","taint analysis","vulnerability detection","LLM agents","security auditing","zero-day vulnerabilities","prompt evolution","static analysis"],"falsifier":"A manual review of the 106 reported vulnerabilities that finds a substantial fraction cannot be triggered by any natural-language prompt would falsify the claim that the framework produces only confirmed, exploitable results.","tokens_in":2739,"feed_emoji":"🔐","tokens_out":855,"duration_ms":26990,"temperature":0.7,"pith_summary":"The paper presents an automated auditing system for Model Context Protocol servers that connect large language model agents to tools with shell, network, and file-system access. It argues that standard static taint analysis alone produces too many unverified alerts while fixed prompt templates miss the specific parameter shapes needed to trigger multi-step vulnerabilities. VIPER-MCP therefore adds an anchor-query pass that maps static alerts to concrete MCP tool handlers and a dual-mutator prompt evolution loop that iteratively corrects tool selection and deepens parameter reach until an end-to-end exploit trace is produced. In a scan of nearly 40,000 real-world repositories the system located 106 previously unknown vulnerabilities, every one validated by a working proof-of-concept prompt, and 67 of them received CVE assignments. A sympathetic reader would conclude that natural-language interfaces to privileged operations create a new and systematically exploitable attack surface that existing security tools have not addressed.","feed_headline":"Scan of 39k MCP servers yields 106 confirmed zero-days","feed_subtitle":"Two-pass static analysis plus evolved prompts turn static alerts into working exploit traces for LLM tool handlers.","key_machinery":"The anchor-query pass that augments taint alerts with function-level structural context to resolve them to specific MCP tool handlers, combined with dual-mutator prompt evolution that independently corrects tool-selection drift and deepens parameter penetration.","core_discovery":"VIPER-MCP is the first end-to-end framework that both detects taint-style vulnerabilities in MCP servers through a two-pass static analysis and dynamically confirms their exploitability by generating concrete proof-of-concept prompts via feedback-driven dual-mutator evolution, as demonstrated by the discovery of 106 zero-day vulnerabilities across 39,884 open-source repositories, all validated through end-to-end exploit traces with 67 CVE IDs assigned.","pith_inferences":["Developers of LLM agent platforms may need to treat natural-language inputs to tool handlers with the same strictness currently applied to direct API calls.","The approach could be adapted to other agent-tool protocols that similarly expose privileged operations through unstructured command channels.","If prompt evolution continues to improve, security testing of agent systems may shift from static code review toward automated red-teaming with generated natural-language inputs.","Organizations deploying MCP servers in production environments should consider mandatory input sanitization at the tool-handler boundary rather than relying solely on the LLM's safety training."],"forward_implications":["MCP servers that expose shell execution, network access, or file manipulation to LLM-driven calls contain direct natural-language-to-sink paths that can be triggered without traditional code injection.","Two-pass analysis that first identifies candidate sinks and then anchors them to concrete tool handlers reduces the file-level noise that defeats standard taint tools on large codebases.","Iterative prompt mutation that separately repairs tool choice and parameter depth can reach vulnerabilities requiring specific multi-argument shapes that fixed templates miss.","Large-scale scanning of open-source MCP repositories is feasible and yields a high rate of confirmed zero-day findings when dynamic validation is included.","Responsible disclosure of all confirmed issues led to 67 CVE assignments, indicating that the discovered flaws are treated as actionable by the affected projects."],"fun_headline_variants":["VIPER-MCP detects 106 zero-days in 39k MCP servers","39k MCP servers contain 106 confirmed zero-days","Two-pass taint analysis yields 106 MCP zero-days","106 zero-days validated across 39k MCP repositories"],"cache_read_input_tokens":64,"weakest_assumption_plain":"The two-pass static analysis and dual-mutator prompt evolution correctly resolve taint paths to exploitable MCP tool handlers without substantial false positives or missed multi-step vulnerabilities.","fun_headline_variants_meta":{"raw":{"variants":["VIPER-MCP detects 106 zero-days in 39k MCP servers","39k MCP servers contain 106 confirmed zero-days","Two-pass taint analysis yields 106 MCP zero-days","106 zero-days validated across 39k MCP repositories"]},"model":"grok-4.3","cost_usd":0.015173,"raw_usage":{"total_tokens":6479,"prompt_tokens":766,"num_sources_used":0,"completion_tokens":67,"cost_in_usd_ticks":151728000,"prompt_tokens_details":{"text_tokens":766,"audio_tokens":0,"image_tokens":0,"cached_tokens":64},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":5646,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":766,"tokens_out":67,"duration_ms":62362,"temperature":1.0,"reasoning_tokens":5646,"cache_read_input_tokens":64,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-05-21T03:37:28.401968+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A manual review of the 106 reported vulnerabilities that finds a substantial fraction cannot be triggered by any natural-language prompt would falsify the claim that the framework produces only confirmed, exploitable results.","supporting_citations":[],"review_version":1}