ZT-MCP: A Zero-Trust Security Architecture for MCP-Connected AI Agents

Abstract

The Model Context Protocol (MCP) is rapidly becoming the standard interface for enterprise agentic AI tool integration, enabling agents to dynamically discover, register, and invoke external tools and data resources. However, MCP-connected deployments introduce a distinct protocol-level attack surface—including tool spoofing, unauthorized invocation, privilege escalation via tool chaining, and data exfiltration via tool outputs—for which existing pipeline-level governance frameworks provide no enforcement. In this paper, we introduce ZT-MCP, a Zero-Trust security framework for MCP-connected AI agents grounded in a formal capability-based access control model (CapBAC) with attribute-based extensions, enforcing the principle of never trust, always verify at the protocol boundary. ZT-MCP comprises four deployable enforcement components: the Tool Identity Verifier (TIV), the Access Policy Engine (APE), the Data Classification and Output Filter (DCOF), and the Protocol Audit Logger (PAL) with integrated anomaly detection. We present an MCP-specific threat taxonomy anchoring seven threat categories to the protocol layer where each emerges, and evaluate ZT-MCP across five metrics—including Attack Block Rate (ABR) and False Positive Rate (FPR)—demonstrating a 100.0% attack block rate with 39.5ms policy enforcement latency and 0.0% false positive rate on an enterprise data pipeline prototype under a fixed, known attack set. ZT-MCP is explicitly positioned as complementary to pipeline-level governance frameworks such as HITL-AP, addressing the protocol-level trust gap those frameworks assume away. The framework aligns with NIST SP 800-207 (Zero Trust Architecture) and the NIST AI Risk Management Framework. A reference implementation is publicly available at https://github.com/sarmishra/ZT-MCP-Project.