{"id":"https://openalex.org/W7225153802","doi":"https://doi.org/10.48550/arxiv.2611.02527","title":"When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts","display_name":"When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts","publication_year":2026,"publication_date":"2026-11-02","ids":{"openalex":"https://openalex.org/W7225153802","doi":"https://doi.org/10.48550/arxiv.2611.02527"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2611.02527","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2611.02527","pdf_url":"https://arxiv.org/pdf/2611.02527","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2611.02527","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5144436112","display_name":"Junwei Yao","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yao, Junwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5159194974","display_name":"Zike Yang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Zike","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160462822","display_name":"Zhijun Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zhijun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5144392323","display_name":"Yongxi Zhou","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Yongxi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5144449016","display_name":"Wenbo Ye","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ye, Wenbo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.4097000062465668,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.4097000062465668,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.3422999978065491,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.026200000196695328,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/model-context-protocol","display_name":"Model Context Protocol","score":0.847000002861023},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.7229999899864197},{"id":"https://openalex.org/keywords/human-approval","display_name":"human approval","score":0.6200000047683716},{"id":"https://openalex.org/keywords/tool-safety","display_name":"tool safety","score":0.4320000112056732},{"id":"https://openalex.org/keywords/elicitation","display_name":"elicitation","score":0.6990000009536743},{"id":"https://openalex.org/keywords/agent-sdk","display_name":"agent SDK","score":0.6240000128746033},{"id":"https://openalex.org/keywords/data-deletion","display_name":"data deletion","score":0.7480000257492065},{"id":"https://openalex.org/keywords/tool-registry","display_name":"tool registry","score":0.3659999966621399}],"concepts":[{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.7603999972343445},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6819000244140625},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6686999797821045},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.621399998664856},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.5224999785423279},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46470001339912415},{"id":"https://openalex.org/C2778156585","wikidata":"https://www.wikidata.org/wiki/Q174053","display_name":"Relay","level":3,"score":0.427700012922287},{"id":"https://openalex.org/C198531522","wikidata":"https://www.wikidata.org/wiki/Q485146","display_name":"Sample (material)","level":2,"score":0.4187000095844269},{"id":"https://openalex.org/C117978034","wikidata":"https://www.wikidata.org/wiki/Q5422192","display_name":"Extractor","level":2,"score":0.3075000047683716},{"id":"https://openalex.org/C90329073","wikidata":"https://www.wikidata.org/wiki/Q914232","display_name":"Ask price","level":2,"score":0.30230000615119934},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.2867000102996826},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.27469998598098755},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.27000001072883606},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.26499998569488525},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.2565999925136566}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2611.02527","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2611.02527","pdf_url":"https://arxiv.org/pdf/2611.02527","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2611.02527","doi":"https://doi.org/10.48550/arxiv.2611.02527","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2611.02527","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2611.02527","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2611.02527","pdf_url":"https://arxiv.org/pdf/2611.02527","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225153802.pdf","grobid_xml":"https://content.openalex.org/works/W7225153802.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7162113871","https://openalex.org/W7171633816","https://openalex.org/W7214542910","https://openalex.org/W7223461795","https://openalex.org/W7214004735","https://openalex.org/W7225037195","https://openalex.org/W7203915946","https://openalex.org/W7138189915","https://openalex.org/W4416050246","https://openalex.org/W7204838952"],"abstract_inverted_index":{"LLM":[0],"agents":[1],"call":[2],"tools":[3,77,131],"that":[4,88],"delete":[5],"data":[6],"or":[7,39,91,177],"move":[8],"money":[9],"through":[10,43],"the":[11,29,32,41,44,48,68,97,102,106,179],"Model":[12],"Context":[13],"Protocol":[14],"(MCP).":[15],"The":[16],"specification":[17],"asks":[18],"for":[19,171],"a":[20,37,64,95,134],"human":[21,146],"who":[22],"can":[23,35,99],"deny":[24],"tool":[25,38,173],"calls":[26],"but":[27],"splits":[28],"mechanism":[30],"between":[31],"server,":[33],"which":[34,51],"annotate":[36],"ask":[40],"user":[42],"host":[45,49,103],"(elicitation),":[46],"and":[47,85,113],"application,":[50],"decides":[52],"whether":[53],"to":[54,94,187],"prompt.":[55],"We":[56],"measure":[57],"both":[58],"sides":[59],"from":[60],"source":[61],"code.":[62],"In":[63],"1,000-repository":[65],"sample":[66],"of":[67,75,125,141,155,165,182],"official":[69],"MCP":[70],"registry,":[71],"an":[72,160],"estimated":[73],"90%":[74],"destructive":[76,130],"(95%":[78],"CI":[79],"82-95)":[80],"have":[81,117,143],"no":[82,118,144],"server-side":[83],"confirmation,":[84],"most":[86],"servers":[87],"elicit":[89],"proceed,":[90],"fall":[92,186],"back":[93],"flag":[96],"model":[98],"set,":[100],"when":[101],"cannot":[104],"relay":[105],"question.":[107],"Of":[108],"41":[109],"popular":[110],"open-source":[111],"hosts":[112,169],"agent":[114,152],"SDKs,":[115,153],"32":[116],"approval":[119,147],"step":[120],"by":[121,133,148],"default,":[122],"including":[123],"16":[124],"25":[126],"applications.":[127],"Pairing":[128],"sampled":[129],"flagged":[132],"rule-based":[135],"extractor":[136],"with":[137],"these":[138,183],"applications,":[139],"60.7%":[140],"pairs":[142,184],"enforced":[145],"default.":[149],"Through":[150],"four":[151,154],"five":[156],"low-cost":[157],"models":[158],"executed":[159],"injected":[161],"deletion":[162],"in":[163],"479":[164],"960":[166],"runs.":[167],"If":[168],"prompted":[170],"every":[172],"not":[174],"annotated":[175],"read-only":[176],"non-destructive,":[178],"unapproved":[180],"share":[181],"would":[185,192],"5.4%;":[188],"universal":[189],"elicitation":[190],"support":[191],"leave":[193],"56.7%.":[194],"Applications":[195],"should":[196],"therefore":[197],"configure":[198],"approval.":[199]},"counts_by_year":[],"updated_date":"2026-11-06T12:05:46.655746","created_date":"2026-11-04T00:00:00"}