{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:LIH6OPJCAV57FZLIEAPYYDPLAR","short_pith_number":"pith:LIH6OPJC","canonical_record":{"source":{"id":"2506.02040","kind":"arxiv","version":4},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-31T08:01:11Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"aec18a9c3838e93f808a7891f2a9f8f80a7d9ba6cc3d1e952f6d5a636dcb14c7","abstract_canon_sha256":"ea5b8de6223c87cb1834f6da7312c00ff0b2a0dd612a7c2c4668fa9d7ac88b4f"},"schema_version":"1.0"},"canonical_sha256":"5a0fe73d22057bf2e568201f8c0deb04656b06bf55f849712116a78679ad7448","source":{"kind":"arxiv","id":"2506.02040","version":4},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.02040","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"arxiv_version","alias_value":"2506.02040v4","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.02040","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"pith_short_12","alias_value":"LIH6OPJCAV57","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"pith_short_16","alias_value":"LIH6OPJCAV57FZLI","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"pith_short_8","alias_value":"LIH6OPJC","created_at":"2026-07-05T12:11:18Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:LIH6OPJCAV57FZLIEAPYYDPLAR","target":"record","payload":{"canonical_record":{"source":{"id":"2506.02040","kind":"arxiv","version":4},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-31T08:01:11Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"aec18a9c3838e93f808a7891f2a9f8f80a7d9ba6cc3d1e952f6d5a636dcb14c7","abstract_canon_sha256":"ea5b8de6223c87cb1834f6da7312c00ff0b2a0dd612a7c2c4668fa9d7ac88b4f"},"schema_version":"1.0"},"canonical_sha256":"5a0fe73d22057bf2e568201f8c0deb04656b06bf55f849712116a78679ad7448","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:11:18.450581Z","signature_b64":"uitRpQSlyTRmcSQrnWUclrLHLWYQA9JmqFIjnr/Tr3LyFAGMdIwGVXHUWlkg9zM40SQaSBTszDjBHcLJdlS7Aw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5a0fe73d22057bf2e568201f8c0deb04656b06bf55f849712116a78679ad7448","last_reissued_at":"2026-07-05T12:11:18.450045Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:11:18.450045Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.02040","source_version":4,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:11:18Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UqksxESpBiGXRJGnE5tC3zvbvzS02raTZxbkzeRLW8XcQ3zAl4GeaPPfPpoE8m7QLjWPLhHrluaacClhrM0RAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-10T16:43:35.937735Z"},"content_sha256":"20de1f62464aadd1eaebb7f362ec6a1c5c20be9405511150ae1986760fd4f0ef","schema_version":"1.0","event_id":"sha256:20de1f62464aadd1eaebb7f362ec6a1c5c20be9405511150ae1986760fd4f0ef"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:LIH6OPJCAV57FZLIEAPYYDPLAR","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Beibei Li, Hao Song, Jiachi Chen, Jiashui Wang, Leixin Guo, Ting Chen, Wenxuan Luo, Xiaosong Zhang, Yiming Shen","submitted_at":"2025-05-31T08:01:11Z","abstract_excerpt":"The Model Context Protocol (MCP) is an emerging standard designed to enable seamless interaction between Large Language Model (LLM) applications and external tools or resources. Within a short period, thousands of MCP services have been developed and deployed. However, the client-server integration architecture inherent in MCP may expand the attack surface against LLM Agent systems, introducing new vulnerabilities that allow attackers to exploit by designing malicious MCP servers. In this paper, we present the first end-to-end empirical evaluation of attack vectors targeting the MCP ecosystem."},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.02040","kind":"arxiv","version":4},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.02040/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:11:18Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0IkJXQrnv8hHk5COvusugN5yzD56ZhNrDuNupCWovtDy9PkQSf3T/m+eiqYlmelSyp4m34Ce1J3l3BQcuWLpBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-10T16:43:35.938094Z"},"content_sha256":"ff8c95ab079289b53df54b5ac7efa80cb1528a86c35207ad9cca79fa70dda694","schema_version":"1.0","event_id":"sha256:ff8c95ab079289b53df54b5ac7efa80cb1528a86c35207ad9cca79fa70dda694"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/LIH6OPJCAV57FZLIEAPYYDPLAR/bundle.json","state_url":"https://pith.science/pith/LIH6OPJCAV57FZLIEAPYYDPLAR/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/LIH6OPJCAV57FZLIEAPYYDPLAR/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-10T16:43:35Z","links":{"resolver":"https://pith.science/pith/LIH6OPJCAV57FZLIEAPYYDPLAR","bundle":"https://pith.science/pith/LIH6OPJCAV57FZLIEAPYYDPLAR/bundle.json","state":"https://pith.science/pith/LIH6OPJCAV57FZLIEAPYYDPLAR/state.json","well_known_bundle":"https://pith.science/.well-known/pith/LIH6OPJCAV57FZLIEAPYYDPLAR/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:LIH6OPJCAV57FZLIEAPYYDPLAR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ea5b8de6223c87cb1834f6da7312c00ff0b2a0dd612a7c2c4668fa9d7ac88b4f","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-31T08:01:11Z","title_canon_sha256":"aec18a9c3838e93f808a7891f2a9f8f80a7d9ba6cc3d1e952f6d5a636dcb14c7"},"schema_version":"1.0","source":{"id":"2506.02040","kind":"arxiv","version":4}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.02040","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"arxiv_version","alias_value":"2506.02040v4","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.02040","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"pith_short_12","alias_value":"LIH6OPJCAV57","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"pith_short_16","alias_value":"LIH6OPJCAV57FZLI","created_at":"2026-07-05T12:11:18Z"},{"alias_kind":"pith_short_8","alias_value":"LIH6OPJC","created_at":"2026-07-05T12:11:18Z"}],"graph_snapshots":[{"event_id":"sha256:ff8c95ab079289b53df54b5ac7efa80cb1528a86c35207ad9cca79fa70dda694","target":"graph","created_at":"2026-07-05T12:11:18Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.02040/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The Model Context Protocol (MCP) is an emerging standard designed to enable seamless interaction between Large Language Model (LLM) applications and external tools or resources. Within a short period, thousands of MCP services have been developed and deployed. However, the client-server integration architecture inherent in MCP may expand the attack surface against LLM Agent systems, introducing new vulnerabilities that allow attackers to exploit by designing malicious MCP servers. In this paper, we present the first end-to-end empirical evaluation of attack vectors targeting the MCP ecosystem.","authors_text":"Beibei Li, Hao Song, Jiachi Chen, Jiashui Wang, Leixin Guo, Ting Chen, Wenxuan Luo, Xiaosong Zhang, Yiming Shen","cross_cats":["cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.02040","kind":"arxiv","version":4},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:20de1f62464aadd1eaebb7f362ec6a1c5c20be9405511150ae1986760fd4f0ef","target":"record","created_at":"2026-07-05T12:11:18Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ea5b8de6223c87cb1834f6da7312c00ff0b2a0dd612a7c2c4668fa9d7ac88b4f","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-31T08:01:11Z","title_canon_sha256":"aec18a9c3838e93f808a7891f2a9f8f80a7d9ba6cc3d1e952f6d5a636dcb14c7"},"schema_version":"1.0","source":{"id":"2506.02040","kind":"arxiv","version":4}},"canonical_sha256":"5a0fe73d22057bf2e568201f8c0deb04656b06bf55f849712116a78679ad7448","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5a0fe73d22057bf2e568201f8c0deb04656b06bf55f849712116a78679ad7448","first_computed_at":"2026-07-05T12:11:18.450045Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:11:18.450045Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"uitRpQSlyTRmcSQrnWUclrLHLWYQA9JmqFIjnr/Tr3LyFAGMdIwGVXHUWlkg9zM40SQaSBTszDjBHcLJdlS7Aw==","signature_status":"signed_v1","signed_at":"2026-07-05T12:11:18.450581Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.02040","source_kind":"arxiv","source_version":4}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:20de1f62464aadd1eaebb7f362ec6a1c5c20be9405511150ae1986760fd4f0ef","sha256:ff8c95ab079289b53df54b5ac7efa80cb1528a86c35207ad9cca79fa70dda694"],"state_sha256":"74128c382cd8adc402e9dd307bb051bf5a7ad22f88a684188c83e69b81d652de"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DEaGS7M4DdYDWjrhVH8J/80V9YT04DdDYngietwp5Qm2Do1s07D24k0q6cQik5IEhEteNFUkjzQUKHB5CbgtBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-10T16:43:35.940472Z","bundle_sha256":"d3567136263eca84bb54daa8a486be5a6cc7218e0ef1745c7e5d5709c439addf"}}