FlowGuard: Evidence-Grounded Detection System for MCP Server Vulnerabilities
First seen Jul 17, 2026 · Updated Jul 17, 2026
This is a defensive security research paper describing FlowGuard, a detection system that identifies real vulnerabilities (like command injection and file system access risks) in MCP servers by combining semantic analysis with runtime evidence verification. It is not an active exploit or attack technique, but rather a scanner designed to help defenders find genuine risks in the MCP ecosystem, which it did find in real-world servers (523 findings across 326 servers). The paper itself poses no direct threat; it highlights that underlying vulnerabilities in MCP tool implementations are prevalent enough to warrant sophisticated detection tooling.
Technical Analysis
MCP servers expose tools via metadata and accept invocations from LLM agents, and prior scanners relied on superficial semantic pattern-matching (e.g., flagging any credential-like string) leading to high false-positive rates. FlowGuard improves on this by narrowing down suspicious signals via reconnaissance, generating schema-valid probes to actually invoke tools, and adjudicating results using runtime execution evidence rather than static text alone. The entry point for actual exploitation would be malicious or vulnerable MCP tool servers that allow command injection or unauthorized file system access when invoked by an agent; FlowGuard's contribution is detecting these flaws before an attacker exploits them. The real-world finding of 523 issues across 326 servers indicates that the underlying MCP ecosystem does have exploitable weaknesses, but the referenced artifact is the scanner, not a weaponized attack.
Affected Systems
protocols: MCP
Detection Signatures
- Tool descriptions or metadata containing unvalidated shell command templates
- Tool responses that echo back file paths or system command output without sanitization
- MCP server endpoints accepting unescaped user-controlled strings passed to file system or subprocess-executing tool handlers
- Schema-valid probe requests that trigger unexpected command execution or file access side effects during dynamic scanning
Remediation Steps
- 1
Adopt runtime evidence-based scanning
Use dynamic, evidence-grounded scanners (like FlowGuard) rather than purely semantic/static scanners when auditing MCP servers, to reduce false positives and confirm real exploitability of command injection and file access risks.
- 2
Sandbox and least-privilege tool execution
Run MCP tool servers with minimal file system and process execution privileges, and sandbox command execution paths to limit blast radius if a vulnerability is found.
- 3
Input validation on tool invocation parameters
Ensure MCP server tool handlers strictly validate and sanitize all parameters against injection into shell commands or file system paths.
- 4
Regular security scanning of third-party MCP servers
Before integrating third-party MCP servers into agent workflows, run them through vulnerability detection pipelines and monitor for the vulnerability categories identified in this research (command injection, file system access, and semantic risks in metadata/responses).
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.