Post-Authorization Execution Trust Gap in Remote MCP Tool Invocation

Technical Analysis

The core issue is that standard OAuth-based authorization for MCP tool calls validates identity/permissions at connect or token-issuance time but does not re-verify, at the moment of execution, that the same attested workload is still the one performing the protected operation. This creates several concrete attack classes: workload substitution after authorization, reliance on stale appraisal/attestation state, reuse of delegated authority by an unintended downstream sender, and silent traversal through undeclared downstream components (transitive tool chaining). An attacker or compromised infrastructure component could exploit this gap to execute tool logic under a previously valid authorization even though the actual execution environment has changed, effectively a confused-deputy/TOCTOU-style problem at the protocol layer. ACLE-MCP mitigates this by issuing short-lived, sender-constrained capability leases bound to workload identity, freshness, operation/object/parameter bounds, and downstream constraints, enforced by a provider-side Execution Gate immediately before tool logic runs, with optional vTPM-based quote verification for hardware-rooted workload attestation.

Affected Systems

MCP Python SDK, Keycloak/OIDC-based MCP servers; protocols: MCP, OAuth

Detection Signatures

• Log pattern: tool invocation timestamps significantly later than OAuth token issuance without re-attestation checkpoint
• Log pattern: mismatched workload identity/attestation quote between authorization time and execution time
• Log pattern: authorized calls traversing undeclared or unexpected downstream MCP servers/components
• Log pattern: reuse of a delegated token/authority across a different sender identity than originally granted
• Absence of invocation-time freshness or nonce validation in MCP server tool-call handlers

Remediation Steps

1. 1

   Adopt invocation-scoped authorization

   Do not rely solely on connect-time or token-issuance-time OAuth checks; bind authorization to the specific execution instance via short-lived, sender-constrained capability leases as proposed in ACLE-MCP.

2. 2

   Enforce execution-time workload attestation

   Deploy a provider-side Execution Gate that verifies current workload identity and freshness (e.g., via vTPM quotes) immediately before executing protected tool logic, not just at connection setup.

3. 3

   Constrain and log downstream tool chaining

   Explicitly declare and validate allowed downstream components/tools in the capability lease so that authority cannot be silently extended through undeclared multi-hop tool calls.

4. 4

   Set short authorization freshness windows

   Reduce the validity window of tool-call authorizations and require re-validation for long-running or resumed sessions to limit exposure from stale appraisal state.

5. 5

   Benchmark latency trade-offs before production rollout

   Evaluate the ~25% p95 latency overhead reported in the paper against operational SLAs before adopting full invocation-time binding in latency-sensitive agent pipelines.