Zero-Trust Proof-Gated Agent Architecture (ZPAA): A Comprehensive Security Model for the Model Context Protocol (MCP)
Year: 2025
Type: preprint
Abstract: The Model Context Protocol (MCP) enables AI agents to interact with external tools but enlarges the attack surface to prompt injection, tool poisoning, privilege escalation, remote code execution, data exfiltration, and supply-chain risks. Existing defenses such as TLS, authentication, and heuristics protect communication but leave post-decryption behavior ungoverned. We propose the Zero-Trust Proof-Gated Agent Architecture (ZPAA), which treats large language models (LLMs) as untrusted proposers. ZPAA enforces defensein-depth through a minimal action DSL verified by a deterministic policy engine, single-use capability tokens, sandboxed execution with strict guards, and layered validation via DLP, schema gates, and provenance checks. Audit logs ensure observability and tamper resistance. Contributions include: (1) a taxonomy of MCP vulnerabilities, (2) ZPAA design separating proposal from authority, (3) capability token formalization with a verifying interpreter, and (4) an evaluation framework. Results show ZPAA blocks major MCP attack classes, reducing residual risk to LLM fallibility and rare systemlevel exploits.
Author: Jalendar Reddy Maligireddy
Institutions: University of North Texas, Fiserv (United States)
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W4414115777