{"resourceId":"arxiv-2606-21338-mcp-server-privacy-leakage-detector-20260619","versions":[{"version":"external-3fc48dc8fe209e49c280e2f5d42424311717817d306240cb450d2e86131826fe","resource":{"id":"arxiv-2606-21338-mcp-server-privacy-leakage-detector-20260619","title":"Preprint: static analysis of 10,655 real-world MCP servers finds credential and PII leakage rates above 10%","organization":"Biwei Yan, Minghui Xu, Yijun Yang, Boyang Ma, Xuelong Dai, Jingku Li, Yue Zhang (arXiv authors)","sector":"Academic research / MCP security","geography":"Global open-source ecosystem","publishedAt":"arXiv:2606.21338 v1, submitted 19 Jun 2026","publicationDate":"2026-06-19","eventDate":null,"sourceName":"arXiv","sourceLabel":"\"What Happens Locally, Leaks Globally\": Detecting Privacy Leakage Risks in MCP Servers (Preprint, not peer reviewed)","sourceUrl":"https://arxiv.org/abs/2606.21338","evidenceClass":"academic-research","outcomeClass":"cautionary","topics":["data-security","developers-agents"],"finding":"Preprint, not peer reviewed. The authors argue that leakage in MCP servers is largely protocol-induced: credentials, API keys and personally identifiable information cross the local-to-LLM boundary simply by being returned, logged or raised inside a tool handler, with no explicit outbound request. Their MCPPrivacyDetector uses cross-language static and taint analysis; applied to 10,655 real-world MCP servers it finds leakage rates above 10%, with case studies of leaked bearer tokens, propagated API keys and plaintext authentication credentials.","sledRelevance":"Why now: Palo Alto's Nov. 10 Data Security MCP Server is pitched as safer because it runs locally, and SLED security teams are being invited to connect DLP data to agents. This study shows that local MCP servers still pass secrets and PII into model context, so the local framing does not by itself settle data-protection questions for regulated public-sector data.","evidence":"Opened the arXiv abstract page (v1, 19 Jun 2026, cs.CR; arXiv DOI 10.48550/arXiv.2606.21338). Figures are from the abstract; the full paper was not read, so per-category rates, false-positive rates and whether any vendor-published servers were included are unknown.","architectureImplications":"Interpretation: treat any MCP server, including vendor-supplied ones, as a data path into the model provider; review what tool handlers return and log.","governanceImplications":"Interpretation: MCP server approval should include a code or behavior review for secret and PII exposure, not only a vendor reputation check.","securityPrivacyImplications":"Directly concerns credential and PII leakage into LLM context and logs, relevant to CJIS, HIPAA and FERPA obligations.","caveats":"Preprint, not peer reviewed. Static analysis of open-source servers; it did not evaluate Palo Alto's Data Security MCP Server. 'Above 10%' is an aggregate; the abstract gives no breakdown.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: use this to show customers that MCP risk is about what data flows into the model, not only where the server runs. It supports a measured conversation about Palo Alto's Data Security MCP Server and any other connector: approve them after a data-flow review. It does not show the Palo Alto server leaks anything, because that server was not tested. The value is a credible, vendor-neutral reason to include connector review in any agent rollout.","engineering":"Engineering framing: credentials and PII reach the model when tool handlers return, log or raise them, even without outbound calls. Engineers should review connector tool outputs and logs, use short-lived scoped credentials and redact sensitive fields before data reaches the agent. The study's approach (static taint analysis across languages) is a model for checking in-house MCP servers, while closed vendor servers need runtime output testing instead.","delivery":"Delivery framing: add an MCP server review step to agent rollouts covering tool outputs, logs and error messages for secrets and PII. The application security lead owns the review, with privacy sign-off for regulated data. Acceptance should include a clean leakage scan before production and re-review when connectors change. The main risk is connectors approved on vendor trust alone as their number grows."},"roleDetails":{"sales":{"customerProblem":"Agencies adopting MCP connectors lack a way to judge whether connectors expose credentials or personal data to AI models.","stakeholders":["CISO","Application security lead","Privacy officer","Developers building agents"],"discoveryQuestions":["Which MCP servers are approved, and how were they reviewed?","Do connector logs or outputs contain secrets or PII?","Who owns MCP server approval?"],"valueHypothesis":"A structured MCP review can reduce the chance that connectors leak secrets or regulated data into model context.","potentialEngagement":"An MCP connector inventory and leakage review for a pilot group of agents.","unsupportedClaims":["That Palo Alto's MCP server leaks data","That local deployment prevents leakage","Exact leakage rates for any specific server"]},"engineering":{"fit":"Applies to any MCP server in SLED agent deployments, vendor or in-house.","architectureIntegration":"Review sits in the connector approval and CI pipeline; static or runtime checks on tool handlers.","prerequisites":["MCP server inventory","Access to connector code or test environment","Defined sensitive-data patterns"],"constraints":["Vendor servers may be closed source","Static analysis may miss runtime-only flows"],"security":"Minimize data returned by tools, redact secrets, use scoped short-lived credentials and keep logs out of model context.","proofOfValue":["Run leakage tests on each approved connector","Inspect tool outputs during a sample agent session for secrets and PII"]},"delivery":{"work":"Add MCP leakage review to connector approval and change management.","dependencies":["Application security capacity","Connector inventory","DLP patterns for testing"],"ownership":"Application security lead, with privacy officer sign-off for regulated data.","skillsAdoption":"Developers need training on what tool handlers expose to models.","governanceCheckpoints":["Pre-production leakage review","Re-review on connector updates"],"acceptanceCriteria":["Proposed: no secrets or regulated identifiers in tool outputs or logs in test sessions","Proposed: every production MCP server has a recorded review"],"risks":["Closed-source connectors that cannot be reviewed","Review fatigue as connectors multiply"]}},"retrievedAt":"2026-11-11T03:51:09Z","enrichedAt":"2026-11-11T04:00:05Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Developers building agents need training on what tool handlers expose; no accessibility implications.","procurementImplications":"Interpretation: require vendors of MCP connectors to document data returned to models and logging behavior.","operatingModelImplications":"MCP connector review becomes part of application security change management.","peerReview":"preprint","sourceVerification":{"openedUrl":"https://arxiv.org/abs/2606.21338","referenceExcerpt":"Applied to 10,655 real-world MCP servers, MCPPrivacyDetector finds leakage rates above 10%.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}