Researchers fuzzed 273 open-source MCP servers and verified 253 bugs in 118 of them, led by reflected output, path traversal and log injection. No CVEs yet.
Researchers fuzzing open-source Model Context Protocol (MCP) servers found verified bugs in 343 tools across 118 of 273 reachable servers. The paper, "ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary" (arXiv 2610.13651, submitted 9 October 2026), reports 253 reproducible bugs. Anyone who runs a community MCP server, or wires one into an agent, is affected. The paper assigns no CVEs and reports no disclosure outcomes for the servers.
What the researchers did
ToFu reads each tool's existing metadata and maps every argument to one of 74 semantics-aware sanitizers from a CWE-guided corpus. It then generates schema-valid Atheris fuzzing harnesses and checks results with 21 runtime tracers plus outcome sanitizers. An LLM (gpt-4.1 at temperature 0) only picks sanitizers and seeds; it is not the judge.
The authors started from 13,875 MCPCorpus records and narrowed to 273 servers they could build and reach, exposing 3,405 tools. Each tool got 60 seconds of coverage-guided fuzzing; 34 servers also got 24-hour runs.
What they found
ToFu flagged 508 candidates on 147 servers, combined from several campaigns. Manual review rejected 103 and deduplication removed 152, leaving 253 bugs:
| Class | CWE | Bugs |
|---|---|---|
| Reflected output | 116/79 | 115 |
| Path traversal | 22 | 64 |
| Log injection | 117 | 58 |
| SSRF | 918 | 7 |
| Data exfiltration | 201 | 5 |
| OS command injection | 78 | 3 |
| Leftover temp file | 459 | 1 |
Of the 508 candidates, 182 were semantic violations where the tool returned success anyway, which a crash-based fuzzer would not see.
Servers named in the paper include memory-bank-mcp (path traversal, log injection), mcp-server-commands (command injection), paper-search-mcp (path traversal, log injection, reflected output, exfiltration), directus-mcp and wordpress-mcp-server (SSRF), mcp-media-processor (path traversal) and MCP-Facebook (path traversal, log injection, reflected output, SSRF). A case study describes webpage-screenshot-mcp, whose screenshot tool accepts file:/// URLs and so reads arbitrary paths. Separately, four servers affected the evaluation host during fuzzing: UltimateCoderMCP deleted files outside its workspace, obsidian-mcp followed a fuzzed path outside its vault, tmux-mcp terminated sessions it did not own, and DesktopCommanderMCP spawned processes without limit. The authors ran their fuzzers in a bubblewrap sandbox and say these incidents motivate sandboxing.
ToFu's triage: 508 candidates, 103 rejected, 152 duplicates removed, 253 verified bugs. Source: arXiv 2610.13651.
Caveats
The paper lists no CVEs, vendor responses or fix status, and has no ethics or responsible-disclosure section (checked in the PDF). Its one reported disclosure is a missing pre-execution check in LangGraph 1.2.0, with no stated outcome. Totals were stable across three full runs but individual bugs were not (pairwise Jaccard overlap 0.75 to 0.81). Properties with no observable runtime event are missed, and tools needing credentials or backends were often not exercised. Counts are therefore a floor.
What defenders should do
- Have each tool validate its own inputs (paths confined to a root, URL allow-lists, no shell interpolation). Do not rely on the model or the orchestrator.
- Treat tool arguments as adversarial, since an injected prompt can steer a model into producing them.
- Escape tool output and log fields before they reach logs or the model context.
- Run unfamiliar MCP servers sandboxed with least privilege, and fuzz them there.
Related ThreatFrontier coverage
Individual MCP flaws with CVEs: MCP Fetch Server SSRF (CVE-2026-104120), x64dbg MCP plugin (CVE-2026-107824), MCP Atlassian (CVE-2026-77244), Obot MCP Gateway (CVE-2026-103758), MCP TypeScript SDK (CVE-2026-104850). Design guidance: Architecting Zero Trust for MCP and The Agent Control Plane.