Detecting tool-poisoning and schema drift in MCP servers

Project summary

The Model Context Protocol (MCP) is rapidly becoming the universal standard connecting AI coding agents (Claude Code, Cursor, Windsurf, OpenHands) to local filesystems, developer shells, and enterprise databases. However, the runtime security architecture of MCP is currently unprotected against tool-poisoning and schema drift.

When an AI agent connects to an MCP server, it relies entirely on the server's published JSON tool schemas. If a malicious or compromised MCP server secretly modifies its schema at runtime—injecting prompt overrides into tool descriptions, smuggling arbitrary eval() or exec() commands into default parameter values, or embedding invisible zero-width unicode characters to hijack tool routing—the agent executes attacker-controlled actions with the developer's full local privileges.

Most security tooling focuses on static code analysis or prompt injection firewalls on user prompts. Almost nothing exists to cryptographically verify the integrity of the tool definitions served to the agent at runtime.

mcp-shield-audit provides a low-overhead, cryptographic monitoring layer for MCP ecosystems. It computes deterministic Merkle hash tree fingerprints of tool manifests, enabling runtime drift detection and isolating tool mutations, parameter smuggling, and hidden unicode poisoning before an agent executes a compromised action.

What are this project's goals? How will you achieve them?

Where this project will be in 45 days:

1. Real-Time MCP Configuration Watcher: A background daemon that monitors MCP configuration files (claude_desktop_config.json, Cursor MCP configs) and alerts users immediately upon detecting unauthorized schema drift.
2. Public MCP Attack Taxonomy and PoC Suite: A documented security taxonomy of 20+ MCP tool-poisoning vectors with reproducible test scripts, demonstrating how tool poisoning bypasses standard model guardrails.
3. Automated CI/CD Scanner for MCP Developers: A GitHub Action that MCP server authors can integrate to cryptographically sign and verify their tool manifests on release.
4. VS Code and Cursor Security Extension: A developer extension providing inline warnings when an MCP server has altered its schema signatures since the last verified baseline.

How will this funding be used?

The funding is structured into three tiers:

• $6,000 (Minimum Viable): Funds 18 days of engineering to build the real-time configuration watcher daemon and publish the open MCP attack taxonomy.
• $14,000 (Scale-up): Adds the CI/CD GitHub Action and automated security scanning across 200+ public MCP servers.
• $20,000 (Target): Delivers the full 30-day development roadmap: the real-time daemon, the attack taxonomy, automated CI tooling, and the VS Code and Cursor developer extension.

Budget Breakdown ($20,000 Target):

• Engineering Stipend: $10,500 (30 days full−time @ 350/day)
• Adversarial Red-Teaming and Compute Pool: $5,500 (Fuzzing 500+ public MCP servers, automated payload generation, and agent evaluation)
• Developer Extension Infrastructure: $2,500 (Extension marketplace build pipelines and automated cross-platform test runners)
• Documentation and Attack Registry: $1,500 (Hosting the public registry of verified MCP server hashes and post-mortems)

Who is on your team? What's your track record on similar projects?

Justin Arndt is a systems architect and cybersecurity engineer with extensive experience in cryptographic state verification and runtime policy enforcement.

Track Record (Proof of Work):

• Built and published the working mcp-shield-audit repository prior to funding: https://github.com/j-arndt/mcp-shield-audit
• 40 unit, property, CLI, and stress tests passing with 99% codebase coverage and green GitHub Actions CI on Python 3.12.
• Verified Merkle tree construction scaling to 1,000+ tools with zero performance degradation.
• Implemented pattern gating that prevents false positives on standard developer prose while maintaining 100% detection of zero-width unicode, prompt injection, and code smuggling.

What are the most likely causes and outcomes if this project fails?

1. MCP Specification Churn: Rapid updates to Anthropic's Model Context Protocol specification could require schema parser adjustments. Mitigation: The engine relies on canonical JSON serialization and Merkle tree roots rather than proprietary protocol wrappers, ensuring longevity across specification revisions.
2. Developer Notification Fatigue: Overly aggressive alerts could cause developers to disable monitoring. Mitigation: Strict pattern gating ensures zero false positives on benign developer descriptions, reserving critical alerts for actual structural drift or confirmed malicious payloads.

How much money have you raised in the last 12 months, and from where?

$0. This project has been entirely self-funded and built independently.