University of Tabuk

A signature proves who published a tool, not that the tool will not leak: a validly signed, fully functional MCP tool can fold sensitive items from earlier calls into a request to a policy-allowed destination, and Meta's MCPGuard-Dynamic failed to stop it under all seven configurations. Germline execution instead leaves tool code unexamined and runs each call in disposable copies forked from a data-free germline process, each receiving only the data its destination may see. No unauthorised disclosure was detected across 153 attack runs, against 5.9–74.5% for baseline defences and an ablation, and single-copy calls took 10–49 ms.

A signature proves who published a tool, not that the tool will not leak: a validly signed, fully functional MCP tool can fold sensitive items from earlier calls into a request to a policy-allowed destination, and Meta's MCPGuard-Dynamic failed to stop it under all seven configurations. Germline execution instead leaves tool code unexamined and runs each call in disposable copies forked from a data-free germline process, each receiving only the data its destination may see. No unauthorised disclosure was detected across 153 attack runs, against 5.9–74.5% for baseline defences and an ablation, and single-copy calls took 10–49 ms.