Abstract:

The model context protocol provides a standardized interaction paradigm for tool invocation by LLM-based agents and enables compatibility with third-party servers. However, this open access model makes it difficult to constrain the evolving behavior of agents during multi-step tool invocation, increasing the uncertainty of runtime permission boundaries and consequently introducing risks such as unauthorized access and permission drift. This paper proposed MCP-DAC, a dynamic access control method that integrated fine-grained attribute-based authorization with event-flow graph constraints. During the trial phase, MCP-DAC automatically collected benign tool invocation logs, generated policy-based access control rules, and constructed an event transition graph for each session; at runtime, it performed attribute validation and path validation for each MCP request. Prototype experimental results with MCP Servers in multiple scenarios show that MCP-DAC effectively blocks various anomalous requests while causing limited interference with normal tool invocation workflows.

Key words: model context protocol, dynamic authorization, session event flow graph, policy-based access control