KDCube
← AI Industry News

MCP's Trust Boundary Gets a Fuzzer and a Firewall

A new academic fuzzer, ToFu, surfaced 253 verified bugs across 343 tools in 118 MCP repositories just as Radware shipped a purpose-built MCP Server Protection layer. Meanwhile Microsoft previewed Copilot Studio Hooks for deterministic tool-call checkpoints and AWS added memory TTLs and usage-based bill...

signals03
sources05
watch03

Highlights

  • A new academic fuzzer named ToFu found 253 verified bugs across 343 tools in 118 MCP repositories, drawn from 273 open-source servers and 3,405 tools — path traversal, log injection, and output reflection that crash-based fuzzing misses entirely (arXiv).
  • Radware shipped MCP Server Protection (Oct 14), a purpose-built control layer for protocol abuse, tool/resource enumeration, and AI-driven tool flooding against MCP servers (Help Net Security).
  • Microsoft Copilot Studio previewed Hooks — deterministic lifecycle entry points that can inspect, modify, or block a tool call before it executes (Cloud Wars).
  • Researchers reported a simple "Repeat-After-Me" prompt that bypasses guardrails in six agent frameworks (CSO Online).

Key Signals

  1. The MCP integration layer gets tooled — for attackers and defenders at once

    arXiv paper Oct 9; Radware Oct 14

    ToFu (Penn State, Université Montpellier, Dartmouth) derives semantic security checks from a tool's own metadata and a CWE-guided sanitizer corpus, then auto-generates fuzzing harnesses — surfacing 115 reflected-output, 64 path-traversal, and 58 log-injection flaws (arXiv). The same week, Radware's CTO framed MCP as "a critical integration layer" whose every new connection "expands the attack surface," pitching visibility, behavioral anomaly detection, and policy enforcement at the server (Help Net Security). This is the concrete follow-through to the ungoverned-sprawl census: the tooling to both exploit and defend MCP now exists.

  2. Copilot Studio Hooks put deterministic checkpoints in the agent loop

    Microsoft, preview

    Hooks bind a workflow to lifecycle events — session start, tool call, error — so required actions run every time instead of only when the model decides to (Cloud Wars). The headline capability for operators: inspect, modify, or block a tool call before execution, plus transform results after. It's governance moving into the runtime, echoing the week's broader shift from pre-launch review to enforced in-flight control.

  3. AgentCore Memory adds retention controls and usage-based billing

    AWS, October 2026

    Bedrock AgentCore Memory now supports a TTL for long-term records via recordExpirySpecification (minimum 31 days), gated behind a new UpdateMemoryRecordExpirySpecification IAM permission; short-term memory moves to consumption-based pricing split across ingestion, retrieval, and storage, and Gateway targets now accept private-CA TLS certs (AWS).

Why It Matters / What To Watch

  1. Audit your MCP surface before someone else fuzzes it
    • ToFu's flaw classes (CWE-22/79/116/117) are the ones to grep your own tool handlers for — argument-level, not crash-level (arXiv).
    • Evaluate server-side controls (Radware and peers) as MCP deployments scale past what manual review can cover (Help Net Security).
  2. Deterministic control points are becoming a platform expectation
    • If you run agents in Copilot Studio, Hooks give a centralized place to enforce policy and block risky tool calls — watch the preview's GA terms (Cloud Wars).
    • Prompt-level bypasses like "Repeat-After-Me" are a reminder that model-side guardrails alone don't hold; pair them with runtime enforcement (CSO Online).
  3. Memory is now a governed, metered resource
    • Set retention TTLs deliberately — the 31-day floor and new IAM gate change how long agent context lingers and who can change it (AWS).
    • Model the shift to consumption-based short-term memory pricing in your cost forecasts (AWS).

Quick Links