ToFu evaluates the software boundary behind an agent's tool call. Metadata guides tool-specific semantic checks, but the claimed security properties must hold when the handler executes untrusted arguments. The authors use runtime observations and output checks to identify effects that a schema or crash-only test could miss. The corpus follows a substantial…
Inspect the ClaimsCase · DiggingBeagle record
ToFu reproduced unsafe semantics across MCP tool implementations
ToFu reports 253 manually verified bugs across 118 MCP-server repositories. Its 3,405-tool count describes extracted inventory, while actual execution covered a reachable subset.
Scope
Controlled tool-fuzzing research, disclosed October 9, 2026, covering 273 surveyed MCP servers. The authors did not demonstrate exploitation of all affected tools in production.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- AI role
- AGAINST AI
Basis and provenance
ToFu reports manually verified implementation findings in a reachable subset of a larger extracted corpus. Verification belongs to the paper's authors; public deployment compromise and uniform vendor remediation are not established. Primary passages were inspected in this review, but the pinned contract supplies no grading rubric for A-D or the numeric impact bands; both remain ungraded. This is a source review, not an independent reproduction.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R4-TOFU-1 · CLM-R4-TOFU-2 · CLM-R4-TOFU-3 · ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary
At a glance
An authorization prompt or tool schema is not a substitute for checking arguments, destinations, and effects at the implementation boundary.
Read the implicationsThe tested configuration and permissions of each MCP server affect reachability and real impact. The 253 validated tool weaknesses do not represent 253 independent victim breaches.
Limits and uncertaintyFull account
ToFu evaluates the software boundary behind an agent's tool call. Metadata guides tool-specific semantic checks, but the claimed security properties must hold when the handler executes untrusted arguments. The authors use runtime observations and output checks to identify effects that a schema or crash-only test could miss.
The corpus follows a substantial availability filter. Of 1,404 repositories exposing tools through static extraction, 482 could be prepared and probed, 417 executed at least one call, and 273 met the paper's cleanly executable condition. Those 273 repositories contained 3,405 extracted tools, but only a subset of the tools could actually be exercised. The inventory count must not be presented as complete execution coverage.
ToFu initially flagged 508 candidates and the authors retained 253 bugs after manual verification and deduplication. One implementation defect can affect several tools, which explains why 343 affected tools exceeds the bug count. Their checks include intended semantics: an intentionally exposed script runner is not automatically a command-injection finding. These are author-verified research results within the sampled configurations, not 253 confirmed victim breaches or a prevalence estimate for all MCP deployments.
Mechanism and trust boundary
- 01
Tool metadata
A model or orchestrator treats a described tool as an available capability.
Boundary: A model or orchestrator treats a described tool as an available capability.
- 02
Untrusted arguments
Tool parameters can reach handlers without the semantics asserted by their metadata being enforced.
Boundary: Tool parameters can reach handlers without the semantics asserted by their metadata being enforced.
- 03
Executable effect
A vulnerable handler uses the arguments to perform an unintended file, process or network operation.
Boundary: A vulnerable handler uses the arguments to perform an unintended file, process or network operation.
Timeline
- Oct 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-R4-TOFU-1The 273 executable MCP-server repositories contained 3,405 extracted tools, of which only a subset could be exercised. ToFu's authors report 253 manually verified, deduplicated bugs affecting 343 tools across 118 repositories.supported
Basis: reported finding
- supportsToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundaryprimary disclosure
Section 7.1, dataset construction and reachable denominator; Section 7.5, manual verification.
CLM-R4-TOFU-2ToFu derives tool-specific input checks from metadata, applies sanitizer-guided fuzzing and assesses effects at the tool execution boundary, rather than treating model-generated arguments as automatically safe.supported
Basis: reported finding
- supportsToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundaryprimary disclosure
Abstract: tool-specific oracles, runtime introspection and outcome sanitization.
CLM-R4-TOFU-3ToFu initially flagged 508 candidate bugs across 147 servers; manual verification reduced these to 253 bugs across 118 servers. The authors reproduced behavior and examined intended tool semantics, including avoiding labeling a script runner vulnerable merely for running scripts.supported
Basis: reported finding
- supportsToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundaryprimary disclosure
Section 7.5, opening manual-verification paragraph.
Implications
An authorization prompt or tool schema is not a substitute for checking arguments, destinations, and effects at the implementation boundary.
Unknowns and contradictions
- The tested configuration and permissions of each MCP server affect reachability and real impact.
- The 253 validated tool weaknesses do not represent 253 independent victim breaches.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 140