ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsToFu reproduced unsafe semantics across MCP tool implementations: The 273 executable MCP-server repositories contained 3,405 extracted tools, of which only a subset could be exercised. ToFu's authors report 253 manually verified, deduplicated bugs affecting 343 tools across 118 repositories.

  Section 7.1, dataset construction and reachable denominator; Section 7.5, manual verification.

• supportsToFu reproduced unsafe semantics across MCP tool implementations: ToFu derives tool-specific input checks from metadata, applies sanitizer-guided fuzzing and assesses effects at the tool execution boundary, rather than treating model-generated arguments as automatically safe.

  Abstract: tool-specific oracles, runtime introspection and outcome sanitization.

• supportsToFu reproduced unsafe semantics across MCP tool implementations: ToFu initially flagged 508 candidate bugs across 147 servers; manual verification reduced these to 253 bugs across 118 servers. The authors reproduced behavior and examined intended tool semantics, including avoiding labeling a script runner vulnerable merely for running scripts.

  Section 7.5, opening manual-verification paragraph.