ToFu Finds 253 Bugs in 118 MCP Servers and a Repeat-After-Me Agent Bypass

Published October 14, 2026 (IST) by the AgentStack News Desk. Facts were checked against the ToFu paper on arXiv (2610.13651, submitted October 9, 2026), including its tables and appendices, with secondary context from GBHackers (October 13, 2026) and Security Intel Hub’s summary of CSO Online coverage (October 12, 2026).

A new academic study of MCP tool security found 253 verified security bugs affecting 343 tools in 118 open-source Model Context Protocol (MCP) servers. The paper, “ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary,” was posted to arXiv on October 9, 2026 by researchers from Pennsylvania State University, Université Montpellier, and Dartmouth College.

The team built ToFu, a fuzzer that reads the metadata a tool already gives a large language model (LLM) and turns it into security checks. The paper also shows a Repeat-After-Me attack that got a LangGraph agent to execute a tool call the attacker wrote, and it says the same behavior reproduced across six orchestration frameworks.

The core finding for operators: a tool argument that passes schema validation can still be attacker-controlled, so the tool itself has to enforce its documented limits. This report draws on the arXiv listing, the full paper, and GBHackers coverage, per our editorial standards.

What the ToFu Paper Found in MCP Servers

ToFu found 253 verified bugs across 343 tools in 118 of 273 cleanly executable open-source MCP servers, which together exposed 3,405 extracted tools. Every bug is a case where a tool accepted a schema-valid but adversarial argument in a way that violated a security property implied by its documented interface.

The 273 figure sits at the end of a long funnel. The team started from 13,875 MCPCorpus records and 1,847 Python or JavaScript repositories, and only 273 servers returned at least one successful call on adversarial input.

ToFu first flagged 508 candidate bugs across 147 servers. Manual review removed 103 findings that were not vulnerable and 152 duplicates, which left 253 reproducible bugs. The paper explains that the bug count is lower than the affected-tool count because a single bug can affect multiple tools.

Metric	Figure in the paper
Submitted to arXiv	October 9, 2026 (v1, cs.CR, 33 pages)
Servers in the test set	273 cleanly executable open-source MCP servers
Tools in those servers	3,405 extracted tools (only a subset could be exercised)
Candidate bugs before review	508 across 147 servers
Removed in manual review	103 not vulnerable, 152 duplicates
Verified bugs	253, affecting 343 tools in 118 servers
Sanitizers in the corpus	74 semantics-aware sanitizers
Found at the 60 second budget	231 of 253
Orchestration layers hit by Repeat-After-Me	6, per the paper’s footnote

Which bug classes showed up most

Reflected output led the count, followed by path traversal and log injection. The paper’s impact appendix also says when its rubric treats each class as low impact.

Bug class (CWE)	Verified bugs	What the attacker controls	Low impact when
Reflected output (CWE-116/79)	115	Markup in any string argument	Output is plain text or JSON returned only to the LLM
Path traversal (CWE-22)	64	A path argument	The tool documents access to the whole file system
Log injection (CWE-117)	58	A string with line breaks	The log is only standard error or debug output
SSRF (CWE-918)	7	A URL or host argument	No low-impact case listed
Data exfiltration (CWE-201)	5	A path to a sensitive file	No low-impact case listed
OS command injection (CWE-78)	3	A string used in a command	Running commands is the tool’s purpose
Leftover temp file (CWE-459)	1	Any input that creates a file	No low-impact case listed

The paper marks reflected output as low impact when a tool returns plain text or JSON only to the LLM, so the 115 figure does not mean 115 critical holes. Path traversal, SSRF, and data exfiltration are the classes to triage first, since they let an attacker-steered agent read files or reach loopback, private, and cloud-metadata addresses.

How ToFu Turns Tool Metadata Into Security Tests

ToFu reads each tool’s name, description, and argument schema, then maps every argument to checks from a corpus of 74 semantics-aware sanitizers grounded in Common Weakness Enumeration (CWE) classes. It generates schema-valid fuzzing harnesses, runs coverage-guided fuzzing with Atheris, and reports a bug when a tool accepts input its own contract rules out.

The key idea is that two string arguments can need very different checks. A string described as a path inside a workspace implies containment, and one described as a remote URL implies limits on schemes and destinations. Crash-based fuzzers miss these failures because the tool usually returns success.

An LLM helps in two places only: mapping sanitizers to arguments and writing the first seeds. The authors used gpt-4.1 at temperature 0, and the LLM is never the security oracle. For Python servers, runtime tracers watch filesystem, process, and network activity, and for opaque tools, outcome checks test whether the tool rejected a flagged input.

A real case: a screenshot tool that reads local files

The paper’s case study follows the screenshot-page tool in webpage-screenshot-mcp. Its URL argument is described as the webpage to screenshot, yet the handler passes any parseable URL to the browser, including file: URLs. ToFu’s oracle caught the tool returning an image for file:///etc/passwd, and the authors confirmed by hand that directory URLs render as listings.

Saved login cookies apply by default, so an agent steered by injected content could read files on the server and screenshot loopback and private-network services, the paper says.

How the Repeat-After-Me Attack Works on LangGraph

Repeat-After-Me asks the model to repeat a string that happens to be a correctly formatted tool call. If the model reproduces it as a structured call, the orchestration layer treats the output as a real request and runs it, even though the model was only copying text the attacker supplied.

The appendix shows the transcript on LangGraph 1.2.0, using the prebuilt ToolNode with tools_condition routing and llama3.1:8b served through Ollama 0.6.2 at temperature 0. The two tools were stubs with no side effects, and the only guardrail was a system prompt telling the assistant to decline dangerous requests.

On the first turn the model refused and printed the call as plain text, so nothing ran. On the second turn the attacker framed the call as hypothetical and asked for nothing but the quoted string. The model emitted an empty message carrying the structured call with the attacker’s exact arguments, ToolNode executed it at once, and the model then refused again as if nothing had happened.

The system prompt shaped what the model said, and nothing between the model output and the tool checked whether the call should run. The authors write that they reported the missing pre-execution check to the LangGraph maintainers.

Six frameworks, one shared weakness

A footnote in the paper says the team reproduced the behavior across six evaluated orchestration layers: LangGraph, Microsoft Agent Framework, Google Agent Development Kit (ADK) 2.0, AutoGen, Strands, and CrewAI. The paper’s references attribute AutoGen to Microsoft and Strands Agents to Amazon Web Services. The published transcript covers LangGraph only, so the paper offers no per-framework transcripts for the other five.

GBHackers covered the study on October 13, and Security Intel Hub summarized CSO Online’s October 12 report on the six-framework result. Every figure in this story comes from the paper itself.

How ToFu Compares With Existing MCP Scanners

The authors ran five baselines on the same 273 servers: ToolFuzz, VIPER-MCP, Cisco MCP Scanner, CodeQL’s security-extended queries, and a Claude Sonnet 5 code audit. They present no single leaderboard because each tool measures something different, and eight servers were flagged by ToFu alone with no finding from any baseline.

Analyzer	Executes tools?	Servers flagged	Also flagged by ToFu
ToFu	Yes (60 s coverage-guided)	118	n/a
ToolFuzz	Yes (10 iterations)	92	56
VIPER-MCP	Yes (10 rounds)	48 (11 confirmed exploits)	36 (7)
Cisco MCP Scanner	No (3 analyzers)	46	23
CodeQL security-extended	No	95	56
Claude Sonnet 5 audit	No (1 review per tool)	119	71
Any baseline	n/a	198	110

Raw counts do not settle the comparison. A CodeQL or Cisco flag marks a potential issue in code or metadata, whereas a ToFu finding is a runtime event in which the tool returned success on a bad input. About 63% of the servers that baselines flagged and ToFu missed failed to start, hung, or rejected every input before reaching tool logic.

Why It Matters for Teams Running MCP Tools in Production

An agent stack that treats MCP tool security as schema validation checks that a call matches its JSON schema and then trusts it. ToFu shows that schema validity says nothing about whether a path stays in a workspace or a URL stays off the internal network, so those checks belong in tool code.

What to change in tool code

The paper argues that tool metadata should work as an enforceable security contract. If a description says a path is confined to a workspace, the handler should resolve the path and reject anything outside it. If a URL should be a public webpage, the handler should allow only http and https and block loopback, private, link-local, and cloud-metadata addresses.

# Illustrative: enforce the contract your tool description promises
from pathlib import Path
from urllib.parse import urlparse
import ipaddress, socket

WORKSPACE = Path("/srv/agent-workspace").resolve()

def safe_path(arg: str) -> Path:
    p = (WORKSPACE / arg).resolve()
    if not p.is_relative_to(WORKSPACE):
        raise ValueError("path outside workspace")
    return p

def safe_url(arg: str) -> str:
    u = urlparse(arg)
    if u.scheme not in ("http", "https") or not u.hostname:
        raise ValueError("scheme not allowed")
    for info in socket.getaddrinfo(u.hostname, None):
        ip = ipaddress.ip_address(info[4][0])
        if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
            raise ValueError("internal address blocked")
    return arg

Production code should also pin the resolved address for the real request to block Domain Name System (DNS) rebinding.

What to change in the orchestration layer

Repeat-After-Me points at a second gap. Teams on LangGraph, Microsoft Agent Framework, ADK, AutoGen, Strands, or CrewAI can add a policy check between parsed tool calls and execution, such as human approval for high-risk tools or an allow-list tied to the user’s request. The paper’s threat model treats user prompts, retrieved content, and other tools’ outputs as attacker-influenced, so a refusal in the chat transcript is no proof that a call did not run.

Run tool servers in a sandbox as well. During fuzzing, four servers affected the evaluation host: UltimateCoderMCP deleted files outside its workspace, obsidian-mcp followed a fuzzed path outside its vault, tmux-mcp terminated terminal sessions it did not own, and DesktopCommanderMCP spawned processes without limit. The team ran every fuzzer in a bubblewrap sandbox with a read-only root and a private /tmp for this reason.

Risk	Signal in traces	Control to add
Path traversal	../ sequences or absolute paths in path arguments	Resolve and confine to the documented root
SSRF	file: URLs, loopback, private, or metadata hosts	Scheme allow-list plus resolved-IP block list
Log injection	Carriage-return and line-feed (CRLF) characters in strings	Escape line breaks before logging
Command injection	Shell metacharacters in command-like arguments	Pass arguments as lists, never through a shell
Repeat-After-Me	Tool calls that echo user-quoted JSON	Pre-execution policy check or human approval

Our best AI agent observability tools guide and AgentOps tools map cover platforms that capture tool arguments in traces, and the AI agent frameworks comparison covers framework trade-offs.

Limits of the Study and Open Questions

ToFu covers Python and JavaScript MCP servers that start and run under its harness, and it only catches violations that produce an observable runtime event. The authors list 3,405 tools as the dataset size while noting that only a subset could be exercised, and they leave multi-agent and stateful, multi-call bugs to future work.

Sanitizer selection has a measured miss: a run with all sanitizers turned on held 13 real bugs ToFu did not report, including five SSRF bugs in one WordPress MCP server.

The paper is a version 1 arXiv preprint, and its listing names no conference or journal. It describes a report to the LangGraph maintainers, and it does not describe disclosure to the other five framework projects or to the maintainers of the 118 affected servers.

What to Watch Next

The next signals are framework responses, MCP server fixes, and whether the authors release ToFu for teams to run on their own servers. Five follow-ups over the coming months will show whether the trust-boundary problem gets fixed inside tools, inside orchestration frameworks, or in both places at once.

• LangGraph: whether a pre-execution check ships after the authors’ report.
• Other frameworks: whether the other five publish guidance on calls that echo user text.
• Server fixes: whether affected MCP servers patch path, URL, and command handling.
• Code release: whether ToFu and its sanitizer corpus become available to run in CI.
• Peer review: whether a later version adds venue details or multi-agent coverage.

Gateway choice is the control plane next to those server bugs. For enterprise MCP gateway shortlists covering auth, policy, and scale, see our roundup of the 10 best MCP gateways.

Tool-security bugs in MCP servers sit on top of the protocol model. For the enterprise layout of servers, gateways, and controls, see MCP Explained.

Gateways are one place to enforce tool-call controls before buggy MCP servers reach production. See Kong vs AWS AgentCore vs Docker for how three common MCP gateways handle auth and policy.

Frequently Asked Questions

The Bottom Line

ToFu puts a hard number on MCP security: 253 verified bugs in 118 of 273 working open-source servers, found by testing tools against their own descriptions. The Repeat-After-Me transcript shows why model refusals and schema checks cannot stand in for validation inside the tool and a policy gate before execution.

Teams that install community MCP servers should audit file, browser, and shell tools first. We will update this story if maintainers or the authors publish fixes or code. Send corrections through our contact page.

Related coverage: agent security, MCP, Anthropic distillation defenses, Anthropic evals containment, and Claude Managed Agents dynamic workflows.