Evaluating Security and Reliability of Stateless Model Context Protocol Gateways

Abstract

The July 2026 revision of the Model Context Protocol (MCP) introduces a stateless request model and routing headers that enable conventional HTTP gateway controls for language-model tools. This study examines whether three deterministic controls—tool-definition pinning, least-privilege tool exposure, and argument-level policy enforcement—prevent unauthorized requests from reaching a backend without rejecting authorized operations. We implemented a minimal HTTP/JSON-RPC gateway prototype and evaluated eight combinations of the controls in a 2 × 2 × 2 factorial design. Each configuration received 120 synthetic adversarial requests (40 changed tool descriptors, 40 out-of-scope calls, and 40 disallowed argument sets), 60 valid requests, and 400 timed valid requests over loopback. In this limited implementation, the unprotected baseline rejected none of the 120 adversarial cases, whereas the configuration applying all three controls rejected all 120; each single control rejected precisely the 40 cases constructed to violate its rule. All configurations completed 60 of 60 valid requests. Median observed HTTP latency was 0.533 ms for the baseline and 0.530 ms for the full-control configuration, but these loopback timings do not establish production-scale performance equivalence. The findings demonstrate coverage of the specified access-control invariants, not resistance to model-driven prompt injection. We offer a reproducible pilot methodology and identify the model-in-the-loop, distributed-systems, and identity-validation experiments necessary for stronger external validity.