{"as_of":"2026-08-01T09:50:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:e9f214633bc99c0d0c7436e7c7565af569983747571928c626f43ef3ae443653","coverage":[{"denominator":78,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":78,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-21T10:41:17.307952Z","state":"measured"},{"denominator":84,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":84,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-01T06:32:01.292127+00:00","state":"measured"},{"denominator":6,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":6,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-12T17:06:32.429160Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-02T14:37:03.245592Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"cited_work":{"arxiv_id":"2604.01905","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.01905","snapshot_observed_at":"2026-07-02T14:37:03.245592Z","title":"Huang, Z","venue":"cs.CR","work_id":"4e9b9c89-da60-4d82-8f33-824ceeba8bbd","year":2026},"citing_paper":{"arxiv_id":"2602.11327","last_updated":"2026-04-17T15:12:16Z","snapshot_observed_at":"2026-07-06T22:45:34.674215Z","submitted_at":"2026-02-11T19:58:23Z","title":"Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP","version":2},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-05-16T05:05:16.370606Z"},"links":{"cited_paper":"/paper/2604.01905","citing_paper":"/paper/2602.11327"},"observation_digest":"sha256:4ab165e211c39f305b2b6c246ab36adb0bc267addadb3c0785b0e24cabeb3f4a","observation_id":"752c202b-71bb-45d6-8550-ba2b816a2398","resolution":{"observed_at":"2026-05-20T02:04:54.422307Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.01905","snapshot_observed_at":"2026-07-12T17:06:32.429160Z","title":"From component manipulation to system compromise: Understanding and detecting malicious mcp servers.arXiv preprint arXiv:2604.01905,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2605.11046","last_updated":"2026-07-06T14:50:31Z","snapshot_observed_at":"2026-07-12T17:06:30.437834Z","submitted_at":"2026-05-11T12:41:36Z","title":"On the dilaton gravity of analogue black holes","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-12T17:06:32.429160Z"},"links":{"cited_paper":"/paper/2604.01905","citing_paper":"/paper/2605.11046"},"observation_digest":"sha256:4f54e661df4e05d38d218a44560cf4a76bb5e0009082bcf06384687d87cb45f9","observation_id":"5639f668-386b-4f04-a5a0-7b08325695da","resolution":{"observed_at":"2026-07-12T17:06:32.429160Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"cited_work":{"arxiv_id":"2604.01905","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.01905","snapshot_observed_at":"2026-07-02T14:37:03.245592Z","title":"Huang, Z","venue":"cs.CR","work_id":"4e9b9c89-da60-4d82-8f33-824ceeba8bbd","year":2026},"citing_paper":{"arxiv_id":"2605.11047","last_updated":"2026-05-11T13:20:02Z","snapshot_observed_at":"2026-07-06T23:22:57.012338Z","submitted_at":"2026-05-11T13:20:02Z","title":"Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClaw","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-13T00:53:56.517406Z"},"links":{"cited_paper":"/paper/2604.01905","citing_paper":"/paper/2605.11047"},"observation_digest":"sha256:2dbcbb7839e2214c072f2f8900d7c2469b04962c2f5c2751c5124e69d3f910c8","observation_id":"4b4a796b-e468-4543-b6db-164ddba2081b","resolution":{"observed_at":"2026-05-20T02:04:54.422307Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"cited_work":{"arxiv_id":"2604.01905","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.01905","snapshot_observed_at":"2026-07-02T14:37:03.245592Z","title":"Huang, Z","venue":"cs.CR","work_id":"4e9b9c89-da60-4d82-8f33-824ceeba8bbd","year":2026},"citing_paper":{"arxiv_id":"2605.11770","last_updated":"2026-05-12T08:41:09Z","snapshot_observed_at":"2026-07-06T23:23:34.924221Z","submitted_at":"2026-05-12T08:41:09Z","title":"Behavioral Integrity Verification for AI Agent Skills","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-13T05:54:34.922851Z"},"links":{"cited_paper":"/paper/2604.01905","citing_paper":"/paper/2605.11770"},"observation_digest":"sha256:7596da7427e7ee8eb0c32f666725c8c7a330512f55110e67d2fa08a7ef05286a","observation_id":"4c5bf377-26d3-46e0-8e61-90717d3dd3ac","resolution":{"observed_at":"2026-05-20T02:04:54.422307Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"cited_work":{"arxiv_id":"2604.01905","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.01905","snapshot_observed_at":"2026-07-02T14:37:03.245592Z","title":"Huang, Z","venue":"cs.CR","work_id":"4e9b9c89-da60-4d82-8f33-824ceeba8bbd","year":2026},"citing_paper":{"arxiv_id":"2606.00448","last_updated":"2026-05-30T00:38:07Z","snapshot_observed_at":"2026-07-06T23:41:10.825760Z","submitted_at":"2026-05-30T00:38:07Z","title":"When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-06-28T18:45:33.322389Z"},"links":{"cited_paper":"/paper/2604.01905","citing_paper":"/paper/2606.00448"},"observation_digest":"sha256:4a3a72da3ba3970ca232f9f842596354956e29d827b43ad91de4aa3540c398a4","observation_id":"d62ceabc-b69f-4b78-91d6-66fb54856e84","resolution":{"observed_at":"2026-06-28T19:52:36.039055Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"cited_work":{"arxiv_id":"2604.01905","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.01905","snapshot_observed_at":"2026-07-02T14:37:03.245592Z","title":"Huang, Z","venue":"cs.CR","work_id":"4e9b9c89-da60-4d82-8f33-824ceeba8bbd","year":2026},"citing_paper":{"arxiv_id":"2606.06387","last_updated":"2026-06-04T16:52:43Z","snapshot_observed_at":"2026-07-06T23:46:15.936608Z","submitted_at":"2026-06-04T16:52:43Z","title":"WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-06-28T00:25:05.443939Z"},"links":{"cited_paper":"/paper/2604.01905","citing_paper":"/paper/2606.06387"},"observation_digest":"sha256:fcfec097a40fb6ab72a176032a2899ae7c532c750d148205444fe45e18b2f572","observation_id":"5f52ee4b-68c4-4a30-86b3-b9eaf2d97f1a","resolution":{"observed_at":"2026-07-02T14:37:03.247134Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2604.01905/citation-record","integrity":"/paper/2604.01905/integrity","json":"/paper/2604.01905/citation-record.json","paper":"/paper/2604.01905"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"The work-averse cyberattacker model: theory and evidence from two million attack signatures","venue":null,"work_id":"2530cdd0-ddd7-4b3b-8d7c-c96cd298f5d1","year":2022},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:2172c9b8cf0539f7d3bae7bba0feab15126edc6fce1e56e103b321a3c423e40e","observation_id":"2192dcf6-10b3-41a4-8788-9a515de1430d","resolution":{"observed_at":"2026-05-21T10:45:00.928011Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"8beab8f9-ace8-4ad5-bf59-1077c4e62a45","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:61c9e7395a21a29b860885eadf69a49310cc99de1f64e0f654fbd37ddf8c593a","observation_id":"5b076f73-67fc-4324-a716-f5057198580e","resolution":{"observed_at":"2026-05-21T10:45:00.760560Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Introducing the model context protocol","venue":null,"work_id":"69dbd318-5829-404d-8a52-42410ab599e0","year":2024},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:0ac5e0b170a52cf1f4f81bbe68aac98ae6d8e860c3f98ffe27466a974a0fcc05","observation_id":"d974657e-62c4-491a-bb1f-cda08b211498","resolution":{"observed_at":"2026-05-21T10:45:00.752549Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.01333","last_updated":"2025-06-02T05:22:38Z","snapshot_observed_at":"2026-07-06T21:34:48.355215Z","submitted_at":"2025-06-02T05:22:38Z","title":"ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control","version":1},"cited_work":{"arxiv_id":"2506.01333","doi":"10.48550/arxiv.2506.01333","metadata_source":"pith","pith_arxiv_id":"2506.01333","snapshot_observed_at":"2026-07-11T02:47:51.161132Z","title":"ETDI: Mitigat- ing tool squatting and rug pull attacks in Model Context Protocol (MCP) by using OAuth-enhanced tool defini- tions and policy-based access control","venue":"cs.CR","work_id":"5f595e24-37c7-4729-869c-4529e6e0bf5f","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2506.01333","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:1d03fb18f50c1d8e9d8d3e88bb50f5a596f69ea4a55be5038f4d90701f70f48f","observation_id":"190d6d1c-89dd-4dd9-8611-b51cacb5e869","resolution":{"observed_at":"2026-05-21T10:44:07.968019Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.21236","last_updated":"2026-04-24T09:59:19Z","snapshot_observed_at":"2026-07-06T22:33:58.663508Z","submitted_at":"2025-10-24T08:10:36Z","title":"AgentBound: Securing Execution Boundaries of AI Agents","version":3},"cited_work":{"arxiv_id":"2510.21236","doi":"10.48550/arxiv.2510.21236","metadata_source":"pith","pith_arxiv_id":"2510.21236","snapshot_observed_at":"2026-07-11T02:47:50.288473Z","title":"AgentBound: Securing Execution Boundaries of AI Agents","venue":"cs.CR","work_id":"73bf8253-c0ea-40a5-9420-8bcae2f5438f","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2510.21236","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:d6b62f9de75a1e437bc92bbe3f4ad28c0860bf15498d172971aba16d46e8705c","observation_id":"04dcebb7-a223-47f7-a693-2f6f315df753","resolution":{"observed_at":"2026-05-21T10:44:07.980759Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"46eadd58-4c07-48e4-b2b7-40293411d3be","year":2023},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:07f699e0250316723cf5a6eb4c82df1509c9977f7d897020d20ff498731d14b3","observation_id":"cf88cb01-1c1d-41f8-a5f7-9ceda4af6dff","resolution":{"observed_at":"2026-05-21T10:45:00.750200Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Connect claude code to tools via mcp","venue":null,"work_id":"f70da42a-e932-4767-965f-99c93d9d27e7","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:3537627da2241b2e292af602c1ae0e139c25a34529166ea88162c168bc53fc04","observation_id":"6cb1a0d0-1510-4288-ba2b-5c8f6bcf1e9d","resolution":{"observed_at":"2026-05-21T10:45:00.758296Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Introducing claude 4","venue":null,"work_id":"7c76bd7e-9940-41b4-852c-a4757c8dc216","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:382529190ef61f0faf2efb375df4cc40d741d24e454524581f39306966355615","observation_id":"1057eb7c-15da-4fd6-9555-dacb39523cd1","resolution":{"observed_at":"2026-05-21T10:45:00.807955Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Introducing claude sonnet 4.5","venue":null,"work_id":"f64be860-e16a-41c2-9db3-94fece2ee233","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:18ae3968455fcfcebab813cb1a7045d1168ac2efb1a5893f2bd7b67e625d8a08","observation_id":"097d7d9f-6d32-4edd-adf1-bb0db9005fa8","resolution":{"observed_at":"2026-05-21T10:45:00.916168Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"9c655bc9-3e79-4350-8a3d-747e03ea8795","year":2023},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:d849cb7e9cbc5c8c07ffa79a7667e73c4f47ebe17d32bf14cd1c9dc7976dfea2","observation_id":"ed718e72-705b-4a03-a35c-85707fc2cddc","resolution":{"observed_at":"2026-05-21T10:45:00.805756Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Cursor agent","venue":null,"work_id":"d58ffbf5-9d1d-40ab-a671-c411b5c9a962","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:dd7f79679d34670a27ca04b3b21974863f66c1bb4c199c84cd02b3621dc7ffa4","observation_id":"f494db30-0fca-4313-b980-73ed35f981e8","resolution":{"observed_at":"2026-05-21T10:45:00.755744Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Cursor directory - cursor rules & mcp servers","venue":null,"work_id":"ac9bf59d-8f07-47b3-a14b-3be4a37b1f54","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:bb166ddeab262f56f4a5a59f7d995eda024a7d706dba9a19c9f456c5b6c12f45","observation_id":"b99abbb5-bf61-4b32-bd27-db743fbdb143","resolution":{"observed_at":"2026-05-21T10:45:00.801406Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Model context protocol (mcp) | cursor docs","venue":null,"work_id":"16f7c2cf-0107-4484-97e4-7b53bb6392da","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:e18ec47d3c3a98a2a3a0427be9924d108c149257348124936204e0dd72c945d8","observation_id":"e6acea98-fcab-401f-8d3f-3c563c60a920","resolution":{"observed_at":"2026-05-21T10:45:00.767631Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Deepseek-v3.1","venue":null,"work_id":"3804976c-ad2a-438e-905a-832f2cdfd40a","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:13af5d67998dd4dc98a0bc09cde45bfe7255bf097e9da3fe2eaea90ed0a01631","observation_id":"9e414ee2-0943-40d8-a528-8baa48fdae2a","resolution":{"observed_at":"2026-05-21T10:45:00.813971Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.02279","last_updated":"2025-05-23T00:28:09Z","snapshot_observed_at":"2026-07-06T21:18:50.421957Z","submitted_at":"2025-05-04T22:18:27Z","title":"A survey of agent interoperability protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP)","version":2},"cited_work":{"arxiv_id":"2505.02279","doi":"10.48550/arxiv.2505.02279","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.02279","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"A survey of agent interoperability protocols: Model context protocol (MCP), agent communication protocol (ACP), agent-to-agent protocol (A2A), and agent network protocol (ANP)","venue":null,"work_id":"5a9cf56d-490e-4bd3-84ed-0c631fef8ccd","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2505.02279","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:9256f9adc81f0d52075e5f8e42e339e011f1efbce2e3a75129213332edddfc50","observation_id":"d1f617fa-f6b7-4730-92bd-e13963270dbb","resolution":{"observed_at":"2026-05-21T10:44:07.939641Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.13666","last_updated":"2025-06-16T16:24:31Z","snapshot_observed_at":"2026-07-06T21:43:03.415527Z","submitted_at":"2025-06-16T16:24:31Z","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","version":1},"cited_work":{"arxiv_id":"2506.13666","doi":"10.48550/arxiv.2506.13666","metadata_source":"arxiv_reference","pith_arxiv_id":"2506.13666","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"We should identify and mitigate third-party safety risks in mcp-powered agent systems","venue":null,"work_id":"b22353cd-1606-4671-a46c-a3a4e0f90410","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2506.13666","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:3498dc3d4f60709957ba6e0a047d8f2797694f5cdcaf3096ad72368eacbdbcc0","observation_id":"480a69b4-2b84-4ec8-a628-112915abefca","resolution":{"observed_at":"2026-05-21T10:44:07.943736Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Enhanced prompting framework for code summarization with large language models","venue":null,"work_id":"a51e8ca4-34a4-4b48-9812-15f5f5decc6c","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:4a812a825e9cf8316539b786a10d2298ff9d6e1f98c97bd520e9622b98c14f21","observation_id":"c8f490d6-4eca-43dc-89e4-0ed0090e3984","resolution":{"observed_at":"2026-05-21T10:45:00.765195Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Mcp json configuration","venue":null,"work_id":"aae23d0a-98af-489a-abf2-5b5f54b7104d","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:14fa922077826e2459cdbd983f800877ca500b5aee4003c53d3e407eabcc2d66","observation_id":"0bd7ea9f-9fc7-4e64-9355-7744952aedcb","resolution":{"observed_at":"2026-05-21T10:45:00.792777Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.23370","last_updated":"2025-07-31T09:37:22Z","snapshot_observed_at":"2026-07-06T22:05:38.642936Z","submitted_at":"2025-07-31T09:37:22Z","title":"Trae Agent: An LLM-based Agent for Software Engineering with Test-time Scaling","version":1},"cited_work":{"arxiv_id":"2507.23370","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2507.23370","snapshot_observed_at":"2026-07-04T08:19:43.951695Z","title":"Trae agent: An llm-based agent for software engineering with test-time scaling","venue":null,"work_id":"9bbaf3fb-3f46-415d-bc2c-ecf1cfdd0924","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2507.23370","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:30b33ebe9fef90b93014cf8a80b21e70624e85bf029957b8178c6eac59a5f44f","observation_id":"0e6f0b64-84eb-4c0e-ab11-966dc6d1abaa","resolution":{"observed_at":"2026-05-21T10:44:07.953210Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Malguard: towards real-time, accurate, and actionable detection of malicious packages in pypi ecosystem","venue":null,"work_id":"d55f38c3-c933-4282-a2f2-29fafd015299","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:b59332e6c9feba7acae7d56cfc5339edc62240d520812d54b6ab85f61eb16c97","observation_id":"f665a585-cf79-412e-a57f-bace9f2e3319","resolution":{"observed_at":"2026-05-21T10:45:00.893174Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Github copilot·your ai pair programmer","venue":null,"work_id":"31b0a891-75b6-4258-ab51-7e2fc4a0ed51","year":2021},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:3705f620a677b4cbb426f8dd99fc24d8a79a5f95b90eddaf3d624355d5ad5f45","observation_id":"69abd670-8d92-4cf1-8a7f-2fa323291ef6","resolution":{"observed_at":"2026-05-21T10:45:00.816443Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Extending github copilot coding agent with the model context protocol (mcp)","venue":null,"work_id":"dc593f28-cb2f-4aef-8e51-73a29a652bf9","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:ab24eaa272681483ed5574fe0a7cb4f59150df7700cdc2ea2c10fbdb4faca0ec","observation_id":"af9ac2a0-9b08-41b6-a2b1-9f38f37df736","resolution":{"observed_at":"2026-05-21T10:45:00.905761Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Popular mcp servers","venue":null,"work_id":"faa64325-a4ab-430e-ace4-f4526b64173b","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:90befa268425460944385fe96627d157efef34d400237dbc6943f0eca7527de2","observation_id":"cc436108-e240-47ab-b1e5-7ecb56512c3a","resolution":{"observed_at":"2026-05-21T10:45:00.831449Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Gemini 3","venue":null,"work_id":"da34806c-b5e1-4c40-9e46-dcf3ab12a57b","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:c7b6cffd8cfdfb7f7c414a1b86200a24aff9f6958190cd0641af2a8dfd59e729","observation_id":"49556769-5d8e-43f0-b056-6a58c97919fe","resolution":{"observed_at":"2026-05-21T10:45:00.883813Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Gtfobins","venue":null,"work_id":"673f68a0-5442-4bcf-8c95-395499307baf","year":2022},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:3b15e48de7edf5eecfab8af60129d6b00712c72abaade2dc59d4ace49be19bdc","observation_id":"c6af10fd-2023-4290-93af-dd3a90c10fac","resolution":{"observed_at":"2026-05-21T10:45:00.880459Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2509.25292","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-02T10:46:52.256497Z","title":"A measurement study of model context protocol ecosystem","venue":null,"work_id":"7f64dbec-0608-4fc6-9535-59eec11545d5","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:4f015a4ac5b126617ace7cb1ba1d2604edf2a91d2173b2bbf92db8463586e76f","observation_id":"237775eb-2dfe-45c3-8314-d8a33dae2ce4","resolution":{"observed_at":"2026-05-21T10:44:07.942888Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Large language model based multi-agents: A survey of progress and challenges","venue":null,"work_id":"750a7391-cd27-49b8-a619-35db7e9dcade","year":2024},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:189614a4088b3344e71950aa414aa79c15a45c038ef953c043bcaa9dc8f932d0","observation_id":"f4c4f5bd-186f-43eb-afda-a6d6de454b4f","resolution":{"observed_at":"2026-05-21T10:45:00.887281Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"An empirical study of malicious code in pypi ecosystem","venue":null,"work_id":"4d6c9441-6064-4d89-8d77-d48ce4a40c9b","year":2023},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:5cb3c531a8702de61fc5171fa10c9bd276642b21b98a35e2f67751fa624eb7aa","observation_id":"f42ca10a-0c9e-47a8-b160-17a65403343b","resolution":{"observed_at":"2026-05-21T10:45:00.822770Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.12538","last_updated":"2026-05-25T07:08:19Z","snapshot_observed_at":"2026-07-06T22:14:11.645062Z","submitted_at":"2025-08-18T00:23:41Z","title":"MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security","version":2},"cited_work":{"arxiv_id":"2508.12538","doi":"10.48550/arxiv.2508.12538","metadata_source":"pith","pith_arxiv_id":"2508.12538","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Systematic analysis of mcp security","venue":"cs.CR","work_id":"8fd13327-e45c-448a-b5b9-5157ef86072d","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2508.12538","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:d47ca05f1a3c86f0572edf3579540dfd53b1d4db305ceeed37969690ab448632","observation_id":"557f52d1-9262-408b-aa0d-617d2aa011a9","resolution":{"observed_at":"2026-05-26T03:04:03.989565Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"damn-vulnerable-mcp-server","venue":null,"work_id":"7ecd8142-5237-4012-a9eb-854285642804","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:cbbcce7a0f3d403bbdb9a4c7014dc70a9abc702cd4e6f54478abce40f02bd9a5","observation_id":"4bf2cacd-5007-4fee-a159-f45a7cbbd2e2","resolution":{"observed_at":"2026-05-21T10:45:00.874287Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.13538","last_updated":"2026-04-13T03:45:24Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-06-16T14:26:37Z","title":"Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers","version":5},"cited_work":{"arxiv_id":"2506.13538","doi":"10.48550/arxiv.2506.13538","metadata_source":"pith","pith_arxiv_id":"2506.13538","snapshot_observed_at":"2026-07-11T02:47:50.715137Z","title":"Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers","venue":"cs.SE","work_id":"c7825b29-3cba-435a-a713-36c73899e542","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2506.13538","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:131cff5d8677b3884f8c4979f3b241753d2a163a1c49c01984c0af6b54211f66","observation_id":"1a6ac7e8-b7f1-4bf8-8a9f-b7abfae41d19","resolution":{"observed_at":"2026-05-21T10:44:07.927214Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.14878","last_updated":"2026-05-31T05:10:10Z","snapshot_observed_at":"2026-07-06T22:46:03.525588Z","submitted_at":"2026-02-16T16:10:11Z","title":"Model Context Protocol (MCP) Tool Descriptions Are Smelly! Towards Improving AI Agent Efficiency with Augmented MCP Tool Descriptions","version":3},"cited_work":{"arxiv_id":"2602.14878","doi":null,"metadata_source":"pith","pith_arxiv_id":"2602.14878","snapshot_observed_at":"2026-07-04T06:49:38.271685Z","title":"Model context protocol (mcp) tool descriptions are smelly! towards improving ai agent efficiency with augmented mcp tool descriptions","venue":"cs.SE","work_id":"d6451e03-9e7d-44ad-bf04-310249b15336","year":2026},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2602.14878","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:6b2db7ed2a585f026ba747a3eb96b4777d55f1aaa2fc56b0cc5340b521539db9","observation_id":"bb4db277-4916-498e-a4bf-bc350d7021dc","resolution":{"observed_at":"2026-06-02T02:04:14.693990Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2509.21011","doi":"10.48550/arxiv.2509.21011","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:51.256933Z","title":"Automatic red teaming llm-based agents with model context protocol tools","venue":null,"work_id":"4dac8c3d-d846-476d-96cf-72657895934c","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:d046a5b29468f75c3da91da4c396ac92aaad8b97a675e315b5c4ed946bbc23e9","observation_id":"374bd470-144f-4659-af45-96c6bce02cdd","resolution":{"observed_at":"2026-05-21T10:44:07.957746Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.23278","last_updated":"2025-10-07T07:13:32Z","snapshot_observed_at":"2026-07-06T21:00:55.979837Z","submitted_at":"2025-03-30T01:58:22Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","version":3},"cited_work":{"arxiv_id":"2503.23278","doi":"10.48550/arxiv.2503.23278","metadata_source":"pith","pith_arxiv_id":"2503.23278","snapshot_observed_at":"2026-07-11T02:47:49.588216Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","venue":"cs.CR","work_id":"3eff6b57-ab58-474f-afd9-4e115a5818a9","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2503.23278","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:00ebabb7385c18cde6872c7163b3180f8fe8effa4e9981bab00a799bc8fd4275","observation_id":"ad3df134-ad3c-4cb7-b2e8-102e5387e8b1","resolution":{"observed_at":"2026-05-21T10:44:07.990087Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:23:19.786497+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:23:19.786497+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Donapi: Malicious npm packages detector using behavior sequence knowledge mapping","venue":null,"work_id":"9bb10b95-a0cf-4296-a935-ab2530501536","year":2024},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:a2511195b7607851e45203de20acd7cca53d0047f53968e41704d06a4ec71681","observation_id":"0b855f7a-2327-449f-8479-aeb112e0fd22","resolution":{"observed_at":"2026-05-21T10:45:00.924647Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Spiderscan: Practical detection of malicious npm packages based on graph-based behavior modeling and matching","venue":null,"work_id":"11ddf59a-cac9-453c-9981-482db6770d13","year":2024},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:4a0ad8cb788ddc81668dab7574905ebc1ecd6346a3c6760d86e06a61d15ffe71","observation_id":"e5336804-7bf5-4983-8063-e0585855947a","resolution":{"observed_at":"2026-05-21T10:45:00.910147Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Profmal: Detecting malicious npm packages by the synergy between static and dynamic analysis","venue":null,"work_id":"8df756f9-de67-4e73-9e7a-e646e7ca8700","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:14c4e2a4f4217db0f9cedca46ec73a38896ea8ab3f498faf74ceb7dd6802e524","observation_id":"940bbfca-d0a4-4598-ac5c-25ca81a69d91","resolution":{"observed_at":"2026-05-21T10:45:00.810239Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Mcp security notification: Tool poisoning attacks","venue":null,"work_id":"55347f33-b103-4d57-8333-80d457cf3dd9","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:2f3b8a49eb2cd1aa9cf52cce8bc9c7b8c4c596e2a4bbd95c6988429c72711076","observation_id":"ac8dbf75-a1bd-4f2f-a7ae-1b499f488392","resolution":{"observed_at":"2026-05-21T10:45:00.871660Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Whatsapp mcp exploited: Exfiltrating your message history via mcp","venue":null,"work_id":"03c3b0c4-22f2-4a1f-bc25-07c95d363a0c","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:07033812d234c1be0284cd608d5afb9682cb68243497851e712607a656c2e90e","observation_id":"2cc996c9-c7d4-47d4-82f5-841680381f60","resolution":{"observed_at":"2026-05-21T10:45:00.799035Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"mcp-scan","venue":null,"work_id":"2828f69b-37c9-4073-a07a-71203cc7d03c","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:b4b6620fc4bb3ef1ef559d5a65397f6b1361cd5780ed0f3b9bbeff3b88364e0d","observation_id":"b93c7ea2-0e9e-4075-832d-76a49a6ac8d3","resolution":{"observed_at":"2026-05-21T10:45:00.901534Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-09T10:26:11.307781Z","title":"Mcip: Protecting mcp safety via model contextual integrity protocol","venue":null,"work_id":"75a65b6c-0f68-4467-a744-98acfc54eae7","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:012816c32f1922eccf155f09007a9776add3abdf99af1907dcb213da286fa9ff","observation_id":"8faed80e-5767-4f80-b2a6-42a48012c9d2","resolution":{"observed_at":"2026-05-21T10:45:00.773620Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Joern - the bug hunter’s workbench","venue":null,"work_id":"660af550-1a4c-4ec0-828b-907b280ab801","year":2019},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:d1cc13946ec2ddae80492250462aba5783c2db24ee198d379ef680671c4a1960","observation_id":"5ff15277-1224-4569-b4e6-580f7e8257f9","resolution":{"observed_at":"2026-05-21T10:45:00.868191Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"3 malicious mcp servers found on pypi","venue":null,"work_id":"9e1f761d-0a8c-4cc3-a9ff-c35224292f83","year":2026},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:72f104b93424d2dc9098ee1eb01286c3f24db44c257ec7093cae686beb1dc1e3","observation_id":"f5d8d013-bfe6-4b7a-aeb6-e7e98ec95b30","resolution":{"observed_at":"2026-05-21T10:45:00.762918Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.12757","last_updated":"2025-05-19T08:48:07Z","snapshot_observed_at":"2026-07-06T21:10:51.827270Z","submitted_at":"2025-04-17T08:49:10Z","title":"MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI System","version":2},"cited_work":{"arxiv_id":"2504.12757","doi":"10.48550/arxiv.2504.12757","metadata_source":"pith","pith_arxiv_id":"2504.12757","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Mcp guardian: A security-first layer for safeguarding mcp-based ai system","venue":"cs.CR","work_id":"608d3cfa-8431-4dba-92ac-8fe3ddc4e1a8","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2504.12757","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:6e7741a22992f3a4c106531bea7b9bd6b4926bdcb8fa7b7fb48967ac3c669da9","observation_id":"d4a75edc-5d23-48c4-90e8-3ccd6f41ffae","resolution":{"observed_at":"2026-05-21T10:44:07.990066Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"First malicious mcp server found stealing emails in rogue postmark-mcp package","venue":null,"work_id":"2e74a981-b78f-4218-99f8-410b626b1225","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:69008c7e0e1df2b6914fb0bb8abe26e5efddf73e172ad6db4ff2cea89b8ff18a","observation_id":"0511f971-afff-4b99-837e-03200e6a44f2","resolution":{"observed_at":"2026-05-21T10:45:00.825023Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"The platform for reliable agents","venue":null,"work_id":"0b46168a-b83d-436f-acc5-dbcce5ceb8a9","year":2023},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:78b2025a4e5529b7f3cceae658e9dc34c8aebe99dbdc75c6bad5488579defe7d","observation_id":"e0fe6fa6-cc55-4afd-a851-023ccc31768a","resolution":{"observed_at":"2026-05-21T10:45:00.770378Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"We urgently need privilege management in mcp: A measurement of api usage in mcp ecosystems","venue":null,"work_id":"337cfbd7-2df7-4721-bbde-a32d0be91033","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:ba559832be9290d5f95cd8d212c6789410dd945f629f3664e79ff344b113f8fe","observation_id":"fd25793d-df60-426a-857d-d809ff0e2cce","resolution":{"observed_at":"2026-05-21T10:45:00.865519Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"posts/2025092","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Getting started with model context protocol part 2: Prompts and resources","venue":null,"work_id":"2a90b4cc-8812-4fd8-97eb-37e17ca20352","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:ec3c67bf466b234e04c1c23d0a3e27376b4252fd1a0ec8ef0b8518c66276a3df","observation_id":"7caaed62-d043-489e-922f-6ac0a34b1ef2","resolution":{"observed_at":"2026-05-21T10:44:07.994066Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"From large to mammoth: A comparative evaluation of large language models in vulnerability detection","venue":null,"work_id":"2982130b-0e99-43fc-b6b9-4107406abd68","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:532fbcae326762bd62670b298bb8eed21c5fbf2bc01ad7cb1d2cffabfed5637d","observation_id":"f3df08c5-f9f8-4071-8816-02bdfaf7e621","resolution":{"observed_at":"2026-05-21T10:45:00.862399Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"1d226822-ea68-4e83-94d3-edd9aaa4005a","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:ff9f0efc2f8257344e94e8aecb9eb424e2f942be47093f1bc5bcd5c9473e379c","observation_id":"b9c9b25d-6e4f-4b2f-881a-4d81076ef73a","resolution":{"observed_at":"2026-05-21T10:45:00.854014Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Model context protocol servers","venue":null,"work_id":"3f77ad9a-e6d2-4d20-b5e8-798a7d1428ea","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:9ecc99bc2fcbe33612d0b2644a0c81d20cef19049dce114394415f7cef00dc88","observation_id":"508818d3-bec9-4a0f-a9e8-bef50aba2370","resolution":{"observed_at":"2026-05-21T10:45:00.776123Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.08623","last_updated":"2025-05-02T18:26:39Z","snapshot_observed_at":"2026-07-06T21:07:56.643874Z","submitted_at":"2025-04-11T15:25:58Z","title":"Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies","version":2},"cited_work":{"arxiv_id":"2504.08623","doi":"10.48550/arxiv.2504.08623","metadata_source":"pith","pith_arxiv_id":"2504.08623","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Enterprise-grade security for the model context protocol (mcp): Frameworks and mitigation strategies","venue":"cs.CR","work_id":"80489713-f98e-4575-ab22-f0756c10a0b1","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2504.08623","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:af37b1d5a1214a14ca2a0b21f9f896154693e5c73f2eaa6067e4d7f3a1619e20","observation_id":"20451973-ffc5-4e66-8a24-69b90a79aa7e","resolution":{"observed_at":"2026-05-21T10:44:07.986165Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19951","last_updated":"2025-04-28T16:22:21Z","snapshot_observed_at":"2026-07-06T21:15:54.445465Z","submitted_at":"2025-04-28T16:22:21Z","title":"Securing GenAI Multi-Agent Systems Against Tool Squatting: A Zero Trust Registry-Based Approach","version":1},"cited_work":{"arxiv_id":"2504.19951","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2504.19951","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Securing genai multi-agent systems against tool squatting: A zero trust registry-based approach","venue":null,"work_id":"ff57a198-75c6-4476-818a-927078df4460","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2504.19951","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:09156b20203c48e4c73a714e7fca9ff568ca7dabf4ecc7af755d8d02f9a72b29","observation_id":"6b597d75-0048-4073-80d3-d50b82301b43","resolution":{"observed_at":"2026-05-21T10:44:08.025728Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Backstabber’s knife collection: A review of open source software supply chain attacks","venue":null,"work_id":"a3211fdd-5238-4b8c-ad2c-2497bb35a674","year":2020},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:be8f787b704c5b6f47e7fb2fdfa3774cbacb0a596680ad87f4741a13ac90e285","observation_id":"759924c2-7e4d-4e2e-9f4f-f608a538c621","resolution":{"observed_at":"2026-05-21T10:45:00.851444Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Function calling","venue":null,"work_id":"ff31afa4-8a5c-4e87-88cc-56f64fb0ee81","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:300885478b136419f42482ae58b7c58e554a61919fdb6b4179494c1d78ca3db3","observation_id":"33028c8a-beb2-48a2-8cee-d7f9e4289644","resolution":{"observed_at":"2026-05-21T10:45:00.782142Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Introducing gpt-5","venue":null,"work_id":"c92341f4-b633-486a-9012-733ce9901abc","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:d9a2139efe992d5fb6c010e3273cdb557e7cd27f554daa28a911825cd3c25c44","observation_id":"4378cc40-2157-4422-8e98-0704b9f3d1bf","resolution":{"observed_at":"2026-05-21T10:45:00.889634Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"A distributed vulnerability database for open source","venue":null,"work_id":"e3d85094-50c4-4a57-9fdb-3af9764550eb","year":2026},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:315e62df63751ebf4843cc8d0042297b8a62621c930a9de99cee6318216cbdad","observation_id":"e82346e1-0c7e-4bc3-933c-d07b4ff14b9b","resolution":{"observed_at":"2026-05-21T10:45:00.788211Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Mcp server directory","venue":null,"work_id":"7fddeaa4-df74-40e3-9303-6b0247f48437","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:31afbac2b168f33555fe53061b7ce881253ede1765a32d09be6c7451717bb03a","observation_id":"55bd9afb-305a-4d82-9544-efcec9c496b3","resolution":{"observed_at":"2026-05-21T10:45:00.849001Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Toolllm: Facilitating large language models to master 16000+ real-world apis","venue":null,"work_id":"9dfdcdf8-f0ff-4eca-a498-fcc1f49e63e1","year":2024},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:4371152034461f75116779becb3aa71d5c8c6125003eb96c754a3cf11a04ff11","observation_id":"c9c1a46d-977e-4608-a790-68b1f28e8570","resolution":{"observed_at":"2026-05-21T10:45:00.778559Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.03767","last_updated":"2025-04-11T16:59:05Z","snapshot_observed_at":"2026-07-06T21:04:33.350927Z","submitted_at":"2025-04-02T21:46:02Z","title":"MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits","version":2},"cited_work":{"arxiv_id":"2504.03767","doi":"10.48550/arxiv.2504.03767","metadata_source":"pith","pith_arxiv_id":"2504.03767","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Mcp safety audit: Llms with the model context protocol allow major security exploits","venue":"cs.CR","work_id":"d5c42cc2-8444-459f-bcc5-f36d34de7a47","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2504.03767","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:e9734e1a889dfa58787b0f5bf2e3f5566aa578045992f299114df1ccf6ecae42","observation_id":"78cab1b6-7448-4f6e-b6e2-fb4641a7a53e","resolution":{"observed_at":"2026-05-21T10:44:07.977009Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"A survey on model context protocol: Architecture, state-of-the-art, challenges and future directions.Authorea Preprints","venue":null,"work_id":"88591bf6-b2e3-4dd4-b8a3-871b4c87179f","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:7f0a3ac0ae74b5d80defa77f6d7be7fd030443400ebc56c5d155a3d234286593","observation_id":"03eaeeeb-163c-471c-bca4-1cb5fd48aaa5","resolution":{"observed_at":"2026-05-21T10:45:00.846438Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Benefits of using mcp over traditional integration methods","venue":null,"work_id":"e13eca97-f543-4228-ac52-4bd71b5b9db5","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:e1d27ffaf1164805c3807627bda9a6dc601e0d3c04b67f8015f3821cb9f9d6b4","observation_id":"54548b34-58b5-414b-be75-0152c56d4a7f","resolution":{"observed_at":"2026-05-21T10:45:00.795391Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-07-06T22:00:08.908202Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"cited_work":{"arxiv_id":"2507.15219","doi":null,"metadata_source":"pith","pith_arxiv_id":"2507.15219","snapshot_observed_at":"2026-07-11T02:47:49.968301Z","title":"Promptarmor: Simple yet effective prompt injection defenses","venue":"cs.CR","work_id":"a555d845-f54e-4efb-8504-b885d3481efa","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2507.15219","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:71ffe4f86ff03174f0005c923bf0afb6202d84663a55cf6e5a92d6ed5a35485b","observation_id":"6f94083b-5363-4c64-ae68-4c3e9d4c7b5d","resolution":{"observed_at":"2026-05-21T10:44:07.917743Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Smithery - turn scattered context into skills for ai","venue":null,"work_id":"0a5c3ce9-b1e6-4881-8ef6-cdf66043dc8c","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:19941cf12881193847db72e1b88e03472c3d5bd410a55c52ce72ff22bea0d9b6","observation_id":"8e9cd14e-7176-4805-9696-98998c5cc01f","resolution":{"observed_at":"2026-05-21T10:45:00.843775Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-07-06T21:35:17.779740Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":"2506.02040","doi":"10.48550/arxiv.2506.02040","metadata_source":"pith","pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-07-11T02:47:51.130321Z","title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","venue":"cs.CR","work_id":"899e620a-990a-4612-88fb-8dfed87e3238","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:c2b62322ba72483e424b5170d03a4504d885e7e0c8cdae1ad8d4ed7c277ba639","observation_id":"5cd76137-761b-4c22-b3bd-7ca4b19648dc","resolution":{"observed_at":"2026-05-21T10:44:07.947643Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Ai-infra-guard","venue":null,"work_id":"25263888-4b49-46d5-823a-3fea4e373446","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:1a0823c6e96bdf0e6f46be78e782e7f190258ee76385448ea032bfceac5b8cfd","observation_id":"59d0a1f6-8ca3-4865-8682-9bfef1b3e135","resolution":{"observed_at":"2026-05-21T10:45:00.790557Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.23673","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Mcpguard: Automatically detecting vulnerabilities in mcp servers","venue":null,"work_id":"8c23074c-4087-4c9a-86b9-7a4d6e283dbc","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:866f8e63fca6a8c5fc41f26c29306db8eb3fd7b0b1972ce354d07bf0d8307755","observation_id":"a6b45c99-62b5-4144-b3e0-40c6c33ad2b6","resolution":{"observed_at":"2026-05-21T10:44:07.917949Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Self-instruct: Aligning language models with self-generated instructions","venue":null,"work_id":"2ac3aed9-8312-45a7-ae32-22f644f6ddcc","year":2023},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:cc59a7a99bfb0eaa2d2b46a3ecd6064cd5e60984b51263507a0b73c68aaf3245","observation_id":"7f0717bd-4da2-4e1c-926b-f2302777d49c","resolution":{"observed_at":"2026-05-21T10:45:00.827898Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.11154","doi":"10.48550/arxiv.2505.11154","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Mpma: Preference manipulation attack against model context protocol","venue":null,"work_id":"a2dcd840-29d4-4ee6-b5dc-2eff7e281fb5","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:f9e517383e08a5980a46eb77841032c54eaa755eaaa6b44360c1e15105414363","observation_id":"25d30a3c-c9d9-4a3f-97f2-ada6f168dcee","resolution":{"observed_at":"2026-05-21T10:44:07.998297Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2508.10991","doi":"10.48550/arxiv.2508.10991","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.156666Z","title":"Mcp-guard: A defense framework for model context protocol integrity in large language model applications","venue":null,"work_id":"23467465-0354-4eb7-932b-81c5d9cfe39a","year":2026},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:0c10a847e935868d1e69cb1bf63b6c71d628c5388dfbae029197866d611173d8","observation_id":"a9728051-ec2e-4682-b9db-977ce9237f25","resolution":{"observed_at":"2026-05-21T10:44:07.909577Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.16736","last_updated":"2025-06-21T17:39:43Z","snapshot_observed_at":"2026-07-31T15:41:38.725206Z","submitted_at":"2025-04-23T14:07:26Z","title":"A Survey of AI Agent Protocols","version":3},"cited_work":{"arxiv_id":"2504.16736","doi":"10.48550/arxiv.2504.16736","metadata_source":"pith","pith_arxiv_id":"2504.16736","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"A Survey of AI Agent Protocols","venue":"cs.AI","work_id":"7233e34f-dc80-449b-94df-ceb2ee783ea5","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2504.16736","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:d3cf2c69dd0ea9d745fb2ac305b1fc67cd29da5c3cfb1683c7496329e1282762","observation_id":"38b68d2c-9635-452b-a294-4648e9dbd875","resolution":{"observed_at":"2026-05-21T10:44:07.958043Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2508.13220","doi":"10.48550/arxiv.2508.13220","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Mcpsecbench: A systematic security benchmark and playground for testing model context protocols","venue":null,"work_id":"4a91f798-a23b-4420-afe8-5230f40ee3e1","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:f3d6c1e8359a619df30107daba501bf570e91b53cf6e26fabf4a96367808a667","observation_id":"c36df13c-fe5a-4d3c-a71d-1f949f3eaf95","resolution":{"observed_at":"2026-05-21T10:44:08.021580Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"402ebf10-fbcf-4aab-b198-760aae9ab758","year":2026},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:a701a37a9de0cd3f651f16576d4579a9f02e065db9d6fb93c84650a8fa709709","observation_id":"244e3ed8-d059-4794-890c-d539d3db37c5","resolution":{"observed_at":"2026-05-21T10:45:00.820414Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Williams","venue":null,"work_id":"f1abbe62-4a67-4197-9b24-ccfde67cc3b9","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:47324d4b969291507259ade73ec69b817e07545eaecef44f178cf3876bef3062","observation_id":"d2fff69f-aa24-4e05-922f-1dd85121f632","resolution":{"observed_at":"2026-05-21T10:45:00.840781Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"cbd747e1-1f88-42d6-89ef-fefe0e4f78ed","year":2024},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:190a14335d4790c2ea01e5dc337a9003c7502a1992f51755479893f75eefd146","observation_id":"0c0f68e9-a624-4852-9491-e7d14c8b7d0f","resolution":{"observed_at":"2026-05-21T10:45:00.836062Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.06572","last_updated":"2026-05-01T11:41:26Z","snapshot_observed_at":"2026-07-06T22:25:48.473217Z","submitted_at":"2025-09-08T11:35:32Z","title":"Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem","version":5},"cited_work":{"arxiv_id":"2509.06572","doi":"10.48550/arxiv.2509.06572","metadata_source":"pith","pith_arxiv_id":"2509.06572","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem","venue":"cs.CR","work_id":"ed41d3d5-d33e-4ab4-8d74-654610055482","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"cited_paper":"/paper/2509.06572","citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:53a734eb44797a6cf13f4ccd8bcddcaf84907a4f2708fc170cb5a587df0df97f","observation_id":"d49b879c-3882-4b6c-850e-eeb3ae5ff61a","resolution":{"observed_at":"2026-05-21T10:44:07.972874Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2509.24272","doi":"10.48550/arxiv.2509.24272","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"When mcp servers attack: Taxonomy, feasibility, and mitigation","venue":null,"work_id":"4df473ca-7315-4733-8c17-9a74916114e4","year":2025},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:c57e489ccb65c4db22c4529197edbd3b19964266df3f9094f08020bf21e97bc6","observation_id":"e4c9d553-941b-4b56-91ab-ea72816738bf","resolution":{"observed_at":"2026-05-21T10:44:07.947806Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"–” in the “ID","venue":null,"work_id":"f9ed70ea-d4b9-4303-be00-5a5eaf4f821f","year":1990},"citing_paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers","version":2},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-05-21T10:41:17.307952Z"},"links":{"citing_paper":"/paper/2604.01905"},"observation_digest":"sha256:455882452aed24f976363bb2d03e0863fd760d652892d5e872a92d5bde4ea55f","observation_id":"feffcdfc-5d51-453c-be19-2ad36cfab178","resolution":{"observed_at":"2026-05-21T10:45:00.833954Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-01T06:32:01.292127+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2604.01905","last_updated":"2026-05-19T08:31:57Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T22:51:40.181565Z","submitted_at":"2026-04-02T11:22:07Z","title":"From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers"},"reference_resolution":{"displayed":78,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":6,"verified_exact":25,"verified_fuzzy":47},"total_outbound_references":78},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-01T06:32:01.292127+00:00","source":"crossref"},{"observed_at":"2026-08-01T06:31:58.492377+00:00","source":"retraction_watch"}],"thesis":"As of 1 August 2026, this Paper Citation Record lists 78 of 78 outbound references and 6 inbound Pith citation observations for arXiv:2604.01905."}