Every MCP agent has an unguarded door: the tools it already trusts.
A poisoned tool description, a hidden instruction inside a tool's response, or a server that changes behavior after you approved it can hijack an agent without the user ever typing anything malicious. Prompt-level guardrails don't see it, because the attack never goes through the prompt.

Talk presents research and open source system from Paper published in ACL 2026 Industry Track and EMNLP2026 Demonstration Track

This talk is about what it actually takes to defend that layer in production. I'll walk through the attack classes we see most (from the SAFE-MCP taxonomy, a Linux Foundation / OpenSSF project cataloguing 80+ techniques): tool poisoning, indirect injection via tool responses, rug-pull servers, cross-server shadowing, and exfiltration through legitimate-looking arguments - with live examples of each against a real agent stack.

Then the defense: ShieldMCP, an open-source transparent proxy that sits between any MCP client and server, inspects tool descriptions at discovery, validates every call and response inline, enforces per-tool policy, and blocks or quarantines - with zero changes to the agent, model, or server. ShieldMCP goes in front; same attack, caught.

The part that matters most is what we learned running it: red-team results across 5 model backends (tool-poisoning success 74% → under 9%, indirect injection 47% → under 6%), where it actually hurts, the false-positive patterns that caused developers to bypass it, and the policy defaults we got wrong the first time.

Attendees would leave with a deployable architecture, a pre-approval checklist for vetting any MCP server, and the code.

Key takeaways :

Why prompt-level guardrails miss tool-layer attacks, and the 5 attack classes you should assume you're exposed to today

A drop-in proxy architecture that needs no changes to the agent, model, or server - and where it fits in your existing stack

Real numbers: block rates across 5 backends, latency cost, and the false-positive traps that make teams turn security off

A checklist for vetting an MCP server before approving it (registry provenance, description diffing, response scanning, permission scoping)

Open-source code to run the same attacks and defenses yourself