ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control

--The Model Context Protocol (MCP) plays a crucial role in extending the capabilities of Large Language Models (LLMs) by enabling integration with external tools and data sources. However, the standard MCP specification presents significant security vulnerabilities, notably T ool Poisoning and Rug Pull attacks. This paper introduces the Enhanced T ool Definition Interface (ETDI), a security extension designed to fortify MCP . ETDI incorporates cryptographic identity verification, immutable versioned tool definitions, and explicit permission management, often leveraging OAuth 2.0. We further propose extending MCP with fine-grained, policy-based access control, where tool capabilities are dynamically evaluated against explicit policies using a dedicated policy engine, considering runtime context beyond static OAuth scopes. This layered approach aims to establish a more secure, trustworthy, and controllable ecosystem for AI applications interacting with LLMs and external tools. Index T erms--Model Context Protocol, Large Language Models, AI Security, OAuth 2.0, T ool Poisoning, Rug Pull Attacks, API Security, Policy Engine, Access Control, Cedar, Open Policy Agent. The proliferation of Large Language Models (LLMs) marks a paradigm shift in human-computer interaction, with these models being embedded into a myriad of applications requiring nuanced understanding and generation of natural language. The Model Context Protocol (MCP) [1] has been instrumental in this evolution, providing a standardized mechanism for LLMs to interface with external tools, APIs, and data repositories. This contextual enrichment allows LLMs to transcend their inherent knowledge cut-offs, perform real-world actions, and offer dynamic, personalized user experiences.