Five Hops Through MCP: An Attack Chain in Two Servers and Two Clients

Individual MCP vulnerabilities have been reported. This paper connects them. Five hops, two servers, two clients, 1.3 seconds. No browser, no package install, no config file. The protocol is the attack surface.

Authors

Publication Details

Journal
Zenodo (CERN European Organization for Nuclear Research)
Published
2026-09-15
DOI
https://doi.org/10.5281/zenodo.22781074
Primary Topic
Web Application Security Vulnerabilities
Type
article
Field-Weighted Citation Impact
0.00
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
article

Five Hops Through MCP: An Attack Chain in Two Servers and Two Clients

John Kearney
Zenodo (CERN European Organization for Nuclear Research)
Web Application Security Vulnerabilities
article

Five Hops Through MCP: An Attack Chain in Two Servers and Two Clients

John Kearney
article en

Abstract

Individual MCP vulnerabilities have been reported. This paper connects them. Five hops, two servers, two clients, 1.3 seconds. No browser, no package install, no config file. The protocol is the attack surface.

Zenodo (CERN European Organization for Nuclear Research)
Openalex Percentile: Top 4%
Web Application Security Vulnerabilities
DOIOpen Access PDFOpenAlex
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.

Five Hops Through MCP: An Attack Chain in Two Servers and Two Clients — John Kearney · Zenodo (CERN European Organization for Nuclear Research) (2026) | TGRS Research Map | TGRS