Hybrid Analysis for Secure MCP Tool Use in LLM Agents

As LLM agents increasingly rely on the Model Context Protocol (MCP) to interact with external environments, they face significant security risks from malicious or compromised tools. Existing defenses primarily rely on static analysis, which inspects prompts and tool metadata but fails to observe the actual system-level side effects of tool execution. To address this, the authors propose MTGuard, a hybrid defense framework that monitors the entire lifecycle of an MCP tool invocation: pre-execution, in-execution, and post-execution.

MTGuard functions as a guard agent that intercepts tool calls. It employs a pre-execution auditor to evaluate parameters against safety policies, an in-execution behavioral monitor to capture system-level events (process, file, and network activity) within a sandbox, and a post-execution verifier to confirm that the observed runtime behavior aligns with the intended task.

A central innovation of MTGuard is the tool behavior tree. Traditional process trees often fail to capture the semantic context of an LLM agent's tool use. MTGuard’s behavior tree organizes heterogeneous runtime events—such as process creation, file operations, and network communications—based on their provenance and execution dependencies. This structure allows the system to transform fragmented low-level audit logs into an interpretable description of what a tool actually did, enabling the detection of "execution hijacking" where a tool's metadata is benign but its runtime actions are malicious.

MTGuard was evaluated using the MCP-SafetyBench across browser automation and financial analysis scenarios. The results demonstrate that MTGuard significantly outperforms static-only baselines, detecting 48.3% of unsafe tool calls compared to 8.3% for existing methods. Crucially, it maintains a low false-positive rate of 3.7%, ensuring that security measures do not unduly disrupt benign user tasks. The system introduces only a modest runtime overhead, making it a practical solution for securing real-world LLM agent deployments.