<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="yergattikar-2026-shieldmcp">
    <titleInfo>
        <title>ShieldMCP: An Interactive System for Runtime Security of Model Context Protocol Tool Calls</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Saurabh</namePart>
        <namePart type="family">Yergattikar</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: System Demonstrations</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Sweta</namePart>
            <namePart type="family">Agrawal</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Alberto</namePart>
            <namePart type="family">Abad</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-461-3</identifier>
    </relatedItem>
    <abstract>The Model Context Protocol (MCP) lets large language model agents call external tools, and that tool channel has become a security liability: poisoned tool metadata, injected instructions in tool responses, and malicious servers can subvert an agent while never touching the user’s prompt. These risks are increasingly well documented, but hard to experience: most defenses exist as prose or prototypes. We present SHIELDMCP, an interactive, deployment-ready system that makes both the attack and the runtime defense tangible in a browser. SHIELDMCP operates as a transparent proxy between the LLM client and any MCP server, performing threestage validation: pre-call description integrity, outbound parameter sanitization, and postresponse analysis, all without modifying either the agent or the server. The demonstration exposes the full pipeline through a browser interface in which visitors launch curated attacks, watch each validation stage execute live with per-token highlighting of the detected payload, and submit their own tool descriptions, call parameters, or tool responses to a playground that runs the real detector. On a framework benchmark of 487 attack and 200 benign scenarios across 40 MCP servers, the default rule-based backend reduces the overall attack success rate to 8.6% (from a 70.9% undefended baseline measured against live agents in a companion study) at a median added latency under 20 ms; an optional fine-tuned classifier backend reaches near-zero on this benchmark, though we show this is a withindistribution result that does not yet transfer to paraphrased, multilingual, or encoded attacks. SHIELDMCP is open-source under the Apache-2.0 license and installable with a single pip command; every framework number in this paper is reproducible from the shipped harness.</abstract>
    <identifier type="citekey">yergattikar-2026-shieldmcp</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-demos.20/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>208</start>
            <end>214</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T ShieldMCP: An Interactive System for Runtime Security of Model Context Protocol Tool Calls
%A Yergattikar, Saurabh
%Y Agrawal, Sweta
%Y Abad, Alberto
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: System Demonstrations
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-461-3
%F yergattikar-2026-shieldmcp
%X The Model Context Protocol (MCP) lets large language model agents call external tools, and that tool channel has become a security liability: poisoned tool metadata, injected instructions in tool responses, and malicious servers can subvert an agent while never touching the user’s prompt. These risks are increasingly well documented, but hard to experience: most defenses exist as prose or prototypes. We present SHIELDMCP, an interactive, deployment-ready system that makes both the attack and the runtime defense tangible in a browser. SHIELDMCP operates as a transparent proxy between the LLM client and any MCP server, performing threestage validation: pre-call description integrity, outbound parameter sanitization, and postresponse analysis, all without modifying either the agent or the server. The demonstration exposes the full pipeline through a browser interface in which visitors launch curated attacks, watch each validation stage execute live with per-token highlighting of the detected payload, and submit their own tool descriptions, call parameters, or tool responses to a playground that runs the real detector. On a framework benchmark of 487 attack and 200 benign scenarios across 40 MCP servers, the default rule-based backend reduces the overall attack success rate to 8.6% (from a 70.9% undefended baseline measured against live agents in a companion study) at a median added latency under 20 ms; an optional fine-tuned classifier backend reaches near-zero on this benchmark, though we show this is a withindistribution result that does not yet transfer to paraphrased, multilingual, or encoded attacks. SHIELDMCP is open-source under the Apache-2.0 license and installable with a single pip command; every framework number in this paper is reproducible from the shipped harness.
%U https://aclanthology.org/2026.emnlp-demos.20/
%P 208-214

Markdown (Informal)

[ShieldMCP: An Interactive System for Runtime Security of Model Context Protocol Tool Calls](https://aclanthology.org/2026.emnlp-demos.20/) (Yergattikar, EMNLP 2026)

• ShieldMCP: An Interactive System for Runtime Security of Model Context Protocol Tool Calls (Yergattikar, EMNLP 2026)

ACL

• Saurabh Yergattikar. 2026. ShieldMCP: An Interactive System for Runtime Security of Model Context Protocol Tool Calls. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 208–214, Budapest, Hungary. Association for Computational Linguistics.