Zero-Trust Proof-Gated Agent Architecture (ZPAA): A Comprehensive Security Model for the Model Context Protocol (MCP)

Zero-Trust Proof-Gated Agent Architecture (ZPAA): A Comprehensive Security Model for the Model Context Protocol (MCP) | Authorea try { document.documentElement.classList.add('js'); } catch (e) { } var _gaq = _gaq || []; _gaq.push(['_setAccount', 'G-8VDV14Y67G']); _gaq.push(['_trackPageview']); (function() { var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); })(); Skip to main content Preprints Collections Wiley Open Research IET Open Research Ecological Society of Japan All Collections About About Authorea FAQs Contact Us Quick Search anywhere Search for preprint articles, keywords, etc. Search Search ADVANCED SEARCH SCROLL This is a preprint and has not been peer reviewed. Data may be preliminary. 11 September 2025 V1 Latest version Share on Zero-Trust Proof-Gated Agent Architecture (ZPAA): A Comprehensive Security Model for the Model Context Protocol (MCP) Author : Jalendar Reddy Maligireddy 0009-0002-5881-0084 [email protected] Authors Info & Affiliations https://doi.org/10.22541/au.175761889.90929465/v1 330 views 140 downloads Contents Abstract Supplementary Material Information & Authors Metrics & Citations View Options References Figures Tables Media Share Abstract The Model Context Protocol (MCP) enables AI agents to interact with external tools but enlarges the attack surface to prompt injection, tool poisoning, privilege escalation, remote code execution, data exfiltration, and supply-chain risks. Existing defenses such as TLS, authentication, and heuristics protect communication but leave post-decryption behavior ungoverned. We propose the Zero-Trust Proof-Gated Agent Architecture (ZPAA), which treats large language models (LLMs) as untrusted proposers. ZPAA enforces defensein-depth through a minimal action DSL verified by a deterministic policy engine, single-use capability tokens, sandboxed execution with strict guards, and layered validation via DLP, schema gates, and provenance checks. Audit logs ensure observability and tamper resistance. Contributions include: (1) a taxonomy of MCP vulnerabilities, (2) ZPAA design separating proposal from authority, (3) capability token formalization with a verifying interpreter, and (4) an evaluation framework. Results show ZPAA blocks major MCP attack classes, reducing residual risk to LLM fallibility and rare systemlevel exploits. Supplementary Material File (zapp (1).pdf) Download 479.97 KB Information & Authors Information Version history V1 Version 1 11 September 2025 Copyright This work is licensed under a Creative Commons Attribution 4.0 International License Keywords agent system ai agents artifical intelligence mcp model model context protocol (mcp) proof-gating secure agents zero-trust architecture Authors Affiliations Jalendar Reddy Maligireddy 0009-0002-5881-0084 [email protected] * † * Fiserv, Inc Department of Information Science, University of North Texas View all articles by this author Metrics & Citations Metrics Article Usage 330 views 140 downloads .FvxKWukQNSOunydq8rnd { width: 100px; } Citations Download citation Jalendar Reddy Maligireddy. Zero-Trust Proof-Gated Agent Architecture (ZPAA): A Comprehensive Security Model for the Model Context Protocol (MCP). Authorea . 11 September 2025. DOI: https://doi.org/10.22541/au.175761889.90929465/v1 If you have the appropriate software installed, you can download article citation data to the citation manager of your choice. Simply select your manager software from the list below and click Download. For more information or tips please see 'Downloading to a citation manager' in the Help menu . Format Please select one from the list RIS (ProCite, Reference Manager) EndNote BibTex Medlars RefWorks Direct import Tips for downloading citations document.getElementById('citMgrHelpLink').addEventListener('click', function() { popupHelp(this.href); return false; }); $(".js__slcInclude").on("change", function(e){ if ($(this).val() == 'refworks') $('#direct').prop("checked", false); $('#direct').prop("disabled", ($(this).val() == 'refworks')); }); View Options View options PDF View PDF Figures Tables Media Share Share Share article link Copy Link Copied! Copying failed. Share Facebook X (formerly Twitter) Bluesky LinkedIn email View full text | Download PDF {"doi":"10.22541/au.175761889.90929465/v1","type":"Article"} Now Reading: Share Figures Tables Close figure viewer Back to article Figure title goes here Change zoom level Go to figure location within the article Download figure Toggle share panel Toggle share panel Share Toggle information panel Toggle information panel Go to previous graphic Go to next graphic Go to previous table Go to next table All figures All tables View all material View all material xrefBack.goTo xrefBack.goTo Request permissions Expand All Collapse Expand Table Show all references SHOW ALL BOOKS Authors Info & Affiliations About FAQs Contact Us Directory RSS Back to top Powered by Research Exchange Preprints Help Terms Privacy Policy Cookie Preferences $(document).ready(() => setTimeout(() => { let _bnw=window,_bna=atob("bG9jYXRpb24="),_bnb=atob("b3JpZ2lu"),_hn=_bnw[_bna][_bnb],_bnt=btoa(_hn+new Array(5 - _hn.length % 4).join(" ")); $.get("/resource/lodash?t="+_bnt); },4000)); (function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'a00e0958c80009d6',t:'MTc3OTY0MzkxMw=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();