LLM coding agents such as GitHub Copilot, Cursor, and Claude Code now author a large share of the code that teams merge, and they are active in an estimated 22% of public GitHub projects. The output is fast and usually correct in the small. The trouble is that an agent optimizes for the task in front of it, not the global shape of the system. That cost is now measurable. Agent adoption causally raises code complexity by about 42% and static-analysis warnings by about 30%, and the most common reason an agent’s patch fails is a shallow grasp of the surrounding architecture. We call this widening gap between a system’s intended and realized architecture architectural drift. The obvious remedy, stating the rules in the prompt, does not hold at repository scale; the evidence is that only deterministic, executable enforcement conforms reliably. We make two contributions. The first is a taxonomy of LLM-induced architectural drift: five deterministically enforceable families plus one open frontier, each tied to the architectural primitive it corrupts and the model behavior that produces it. The second is GyroCompass, a deployment-oriented framework. It extracts a living architecture model from source, serves that model to the agent as planning-time context (prevention), and enforces it through a deterministic gate that, run in CI, cannot be bypassed (detection). On a labeled benchmark of 208 cases (104 violations, 104 realistic decoys) spanning Python and JavaScript/TypeScript, GyroCompass reaches 88.5% recall at a 5.8% false-positive rate, versus 57.7% recall at 42.3% false positives for a naive pattern baseline (McNemar p<0.001); on the original 54-case core it separates violations from look-alikes at 100% recall and zero false positives. Head-to-head on matched subsets, a five-tool comparison (Semgrep, Bandit, CodeQL, pip-audit, import-linter) reaches at most 65% recall. Extraction runs at over 800 files per second, cheap enough to apply on every commit, and its output matches independently constructed references at 0.95-1.0 component precision/recall across four repositories. In an added-line analysis of 1,779 commits of a 10k-star production repository whose maintainers document their layering rules for AI agents, violations of the documented intent continued to land, including after an agent-facing AGENTS.md stated the rules,which is the enforcement gap GyroCompass closes. On the prevention side, serving the architecture to a coding agent as context shifts its layering behavior, but the effect is model-dependent across three model families, which is itself why the deterministic gate, not prompt context, is the binding guarantee. We discuss the prevention/detection trade-off, lessons from instrumenting agent workflows, and what reliable guardrails ask of a team in practice. GyroCompass is a working system intended for real-world deployment; benchmark, harness, and analysis scripts are released.

The Model Context Protocol (MCP) lets large language model agents call external tools, and that tool channel has become a security liability: poisoned tool metadata, injected instructions in tool responses, and malicious servers can subvert an agent while never touching the user’s prompt. These risks are increasingly well documented, but hard to experience: most defenses exist as prose or prototypes. We present SHIELDMCP, an interactive, deployment-ready system that makes both the attack and the runtime defense tangible in a browser. SHIELDMCP operates as a transparent proxy between the LLM client and any MCP server, performing threestage validation: pre-call description integrity, outbound parameter sanitization, and postresponse analysis, all without modifying either the agent or the server. The demonstration exposes the full pipeline through a browser interface in which visitors launch curated attacks, watch each validation stage execute live with per-token highlighting of the detected payload, and submit their own tool descriptions, call parameters, or tool responses to a playground that runs the real detector. On a framework benchmark of 487 attack and 200 benign scenarios across 40 MCP servers, the default rule-based backend reduces the overall attack success rate to 8.6% (from a 70.9% undefended baseline measured against live agents in a companion study) at a median added latency under 20 ms; an optional fine-tuned classifier backend reaches near-zero on this benchmark, though we show this is a withindistribution result that does not yet transfer to paraphrased, multilingual, or encoded attacks. SHIELDMCP is open-source under the Apache-2.0 license and installable with a single pip command; every framework number in this paper is reproducible from the shipped harness.

The Model Context Protocol (MCP) has rapidly emerged as the dominant standard for connecting large language models to external tools, databases, and services. Yet this convenience introduces a fundamentally new attack surface that existing LLM safety measures fail to address: adversaries can now compromise AI agents not through the user prompt, but through the tools the agent trusts. We present ShieldMCP, a runtime security framework grounded in two contributions. First, we introduce a structured threat taxonomy derived from analysis of 80+ attack techniques catalogued under the SAFE-MCP initiative within the Linux Foundation’s OpenSSF, spanning 14 tactical categories adapted from the MITRE ATT CK methodology. Second, we describe an interception architecture that performs real-time validation of MCP tool calls and responses, combining structural analysis with semantic intent verification to detect tool poisoning, indirect prompt injection through tool outputs, and supply chain manipulation. In red-team evaluation across five popular LLM backends, ShieldMCP reduces attack success rates from 74% to under 9% for tool poisoning and from 47% to under 6% for indirect prompt injection via tool responses, while adding fewer than 120ms of median latency per tool call. We discuss deployment considerations, the tension between security and agent utility, and lessons applicable to any organization integrating MCP into production workflows. Our framework is categorized as an Emerging system intended for real-world deployment.