Urd
Compositional Trust Analysis for MCP Agent Toolchains
A low-privilege MCP server should not be able to steer a high-privilege tool into deleting data. Urd demonstrates how that boundary can fail in composed agent toolchains, then reconstructs the authority path from trace evidence.
Workshop
“Breaking MCP Trust Boundaries: Cross-Server Authority Injection in Agent Toolchains”
Modern MCP deployments assume that low-privilege tools remain low-risk when reviewed independently. In practice, host agents compose outputs across multiple tools and privilege levels, creating authority paths that do not exist in any single server's standalone review.
This workshop demonstrates a compositional offensive primitive in MCP environments: a low-privilege server influencing the parameters of a high-privilege destructive operation through shared planning context.
Workshop session
Sat Aug 8 · 3:00–4:00 PT · Workshop Stage 2
The live breach, the proof, and the one control that stops it.
Tactic table
Sat Aug 8 · 4:00–5:00 PT · Tactics Area
Hands-on: run the primitive yourself against a target you pick.
The primitive
low-privilege MCP server output ↓ host extraction / planning context ↓ high-privilege destructive tool parameter ↓ accurate but provenance-stripped approval ↓ Urd reconstructs the low-to-high authority path
The dangerous behavior lives in the edges between tools, not inside any one tool. In composed MCP agent toolchains, trust does not automatically compose.
The approval prompt can accurately describe the final action while omitting the upstream provenance that shaped its parameters. That makes human approval semantically incomplete: the operator sees what will happen, but not what influenced it.
The lab
The controlled lab uses two MCP servers over real stdio transport:
Weather
Low-privilege, read-only server.
Admin
Higher-privilege, SQLite-backed server exposing delete_records.
The lab demonstrates a real row deletion where the selected record label comes from the low-trust path:
STAGING_LOG_20260315The observed edge:
server:weather → server:admin:delete_recordsThe baseline run — the same delete with no low-trust hand on the target — produces zero findings. The compositional path produces a HIGH value-flow finding.
Quickstart
Local Python path (no external Python packages required — the repo ships a minimal MCP type shim). A Docker path is also documented in the README.
python3 --version
./lab.sh check
./lab.sh baseline
./lab.sh analyze-baseline
./lab.sh mission
./lab.sh analyze
./lab.sh ablate
./lab.sh analyze-ablated
./lab.sh policy-checkUse the current README in the repository as the source of truth for setup and demo commands.
Open the Urd READMEWhat Urd shows
Declared graph
What the manifests and host configuration say should exist.
Observed graph
What actually happened during runtime.
Divergence
Where observed authority flow exceeds declared expectations.
Urd flags low-privilege tool output influencing high-privilege tool argument construction, approval prompts that omit provenance, and runtime trust edges absent from the declared capability set.
Scope and limits
Urd is not a general MCP interceptor. It is a real-transport offensive research harness that demonstrates cross-server authority injection over MCP stdio and reconstructs the value-flow path even when host-volunteered provenance is removed.
- •Urd is post-mortem and forensic in this release.
- •It analyzes traces; it does not prevent tool calls.
- •It does not detect model exploits, single-server zero-days, or supply-chain compromise inside an MCP server.
- •It is focused on compositional authority flow across MCP toolchains.
Takeaways
- 1Single-server threat models for MCP are structurally incomplete.
- 2Human-in-the-loop approval is semantically incomplete without provenance.
- 3Compositional analysis requires workflow-level tooling.
“Per-tool review will tell you each server is secure. Workflow review will tell you whether the deployment is.”