Evaluating a Layered Prompt-Injection Defence for the Model Context Protocol: A Record-Level Audit of Decision Conventions, Corpus Provenance and Reproducibility

Abstract

The Model Context Protocol (MCP) extends the prompt-injection attack surface of large language model applications to tool descriptions, parameter schemas and tool outputs. Defences for it report detection figures that are not comparable, because each is measured on its authors'own corpus under a decision convention that is rarely stated. This paper audits one such evaluation at the level of individual decision records. Its object is CASCADE, a fully local layered defence (rule matching, embedding similarity and an optional local language-model review), run in three configurations on a frozen 5,000-sample corpus under a pinned code revision; the corpus, the per-sample records and the analysis scripts are public. Four findings result. First, the convention that collapses allow, review and block onto a binary label sets the headline: the pipeline without review reports an 11.70% false-positive rate when referrals count as positives and 1.51% when only denials do, while referring 68.5% of all traffic to a human. Second, the construction of the corpus shapes the aggregate: 65.6% of records are texts placed in one of five fixed wrappers, the wrapper alone identifies the label, and for the same text wrapping lowers the false-positive rate from 21.2% to 3.2% and raises detection from 86.0% to 98.0%. Third, the published description does not identify what ran: the rule module inside the pipeline is not the rule engine evaluated alone; the block threshold produced denials only among the first 48 requests; and, without review, every later denial, including all 23 denials of benign requests, came from an output guard run on an echo of the input. Fourth, the local review model, invoked on 32.6% of requests at 2.5 s each, changes no binary outcome but converts 1,492 referrals into denials. A ten-item reporting checklist is derived from these findings.