Shielding MCP Tool: A Secure Execution Framework Using TEE and Automated Trimming

Large Language Models (LLMs) utilize the Model Context Protocol (MCP) to interact with external tools; however, the protocol’s design lacks inherent security mechanisms. This absence of security creates risks when MCP servers are deployed in untrusted environments, leaving them vulnerable to attacks that could violate authenticity, integrity, and confidentiality. To address these risks, we propose ShieldMCP, a framework to leverage hardware-based Trusted Execution Environments (TEEs) for securing MCP servers. Instead of encapsulating the entire server within a TEE, which would introduce performance overhead and an inflated trusted computing base, our approach applies fine-grained TEE protection at the tool function level, which an LLM can call to perform specific external actions such as querying a database, reading and writing files, or fetching web pages. ShieldMCP employs an automated pipeline: it first scans for tool functions in the MCP server and generates corresponding unit tests using an LLM agent. It then performs dynamic analysis to trim each function’s code. Finally, the resulting smaller artifact is packaged into a TEE and deployed with a secure, attested invocation channel. Our results show that the LLM agent achieved an average test coverage of 97%. The trimming process successfully reduced the code size by an average of 91% while maintaining functional correctness. A qualitative analysis also confirms that this architecture mitigates potential violations.