# Model Context Protocol

13 related articles

Subscribe to updates

arXiv Nov 4, 2026
A valid signature does not stop an MCP tool from leaking: Germline execution gives each call only its cleared data, with zero disclosures in 153 attack runs
A signature proves who published a tool, not that the tool will not leak: a validly signed, fully functional MCP tool can fold sensitive items from earlier calls into a request to a policy-allowed destination, and Meta's MCPGuard-Dynamic failed to stop it under all seven configurations. Germline execution instead leaves tool code unexamined and runs each call in disposable copies forked from a data-free germline process, each receiving only the data its destination may see. No unauthorised disclosure was detected across 153 attack runs, against 5.9–74.5% for baseline defences and an ablation, and single-copy calls took 10–49 ms.
A signature proves who published a tool, not that the tool will not leak: a validly signed, fully functional MCP tool can fold sensitive items from earlier calls into a request to a policy-allowed destination, and Meta's MCPGuard-Dynamic failed to stop it under all seven configurations. Germline execution instead leaves tool code unexamined and runs each call in disposable copies forked from a data-free germline process, each receiving only the data its destination may see. No unauthorised disclosure was detected across 153 attack runs, against 5.9–74.5% for baseline defences and an ablation, and single-copy calls took 10–49 ms.
National University of Singapore Universiti Sains Malaysia University of Tabuk Universiti Tunku Abdul Rahman
Yichiet Aun（First author）
Germline execution Model Context Protocol Signed tool supply-chain attacks Information-flow control
arXiv Nov 10, 2026
A neutron triple-axis spectrometer gets a provenance-keeping assistant: TASCopilot recovers alignment and runs 40 adaptive points on BT-7
A single triple-axis neutron measurement draws on papers, instrument logs, data files and specialist software, and that evidence was previously scattered across separate stages with no traceable link. TASCopilot records sources, processing steps and human review decisions as an inspectable evidence chain, while language models only extract information and explain results; scientific calculations, validation rules and human review decide whether evidence can support a claim. On the BT-7 spectrometer at the NIST Center for Neutron Research it recovered a sample rotation deliberately parked 40° away to within 0.08° of the orientation-matrix prediction, and completed 40 adaptive measurement points with all 40 counted and no refusals.
A single triple-axis neutron measurement draws on papers, instrument logs, data files and specialist software, and that evidence was previously scattered across separate stages with no traceable link. TASCopilot records sources, processing steps and human review decisions as an inspectable evidence chain, while language models only extract information and explain results; scientific calculations, validation rules and human review decide whether evidence can support a claim. On the BT-7 spectrometer at the NIST Center for Neutron Research it recovered a sample rotation deliberately parked 40° away to within 0.08° of the orientation-matrix prediction, and completed 40 adaptive measurement points with all 40 counted and no refusals.
National Institute of Standards and Technology
Carina Jacobson（First author）
TAS Co-pilot Evidence Graph Agentic Retrieval-Augmented Generation Model Context Protocol Triple-axis spectroscopy
NVIDIA Technical Blog Nov 5, 2026
NVIDIA hands DGX SuperPOD operations to AI agents: cross-layer root-cause hunting, read-only access first
NVIDIA built the AI Factory Operations Agent for its own DGX SuperPOD operations so site reliability engineers no longer have to check compute, network, hardware and scheduling dashboards one by one. The agent is a set of domain-specific sub-agents that communicate over MCP, detect failures in production, correlate root causes across layers and surface recommendations through a chat interface. The framework runs as a Kubernetes control-plane application, its tool calls are constrained by read-only credentials and RBAC, and the orchestration framework is released as experimental open source software.
NVIDIA built the AI Factory Operations Agent for its own DGX SuperPOD operations so site reliability engineers no longer have to check compute, network, hardware and scheduling dashboards one by one. The agent is a set of domain-specific sub-agents that communicate over MCP, detect failures in production, correlate root causes across layers and surface recommendations through a chat interface. The framework runs as a Kubernetes control-plane application, its tool calls are constrained by read-only credentials and RBAC, and the orchestration framework is released as experimental open source software.
NVIDIA
AI Factory Operations Agent Agent Orchestration Root Cause Analysis Model Context Protocol Kubernetes
智慧芽（Patsnap） Oct 22, 2026
Patsnap patent and drug data lands inside BenchSci's EMET: preclinical scientists can check target patents and clinical status in one workbench
BenchSci and Patsnap announced that Patsnap's Life Sciences and Patent MCP servers are now available in EMET, so scientists who connect their Patsnap subscription can query drug, target, clinical, patent and literature data directly inside EMET. Previously, patent, clinical and competitive intelligence sat in separate systems from the environment where experiments are designed, and answering questions such as who else has filed on a target or what the clinical status of a compound class is meant leaving the workflow for a separate search. EMET supplies the biological evidence knowledge graph and orchestration layer that let its agents decide when Patsnap intelligence is relevant; the integration is available now but requires a Patsnap MCP subscription licensed directly through Patsnap.
BenchSci and Patsnap announced that Patsnap's Life Sciences and Patent MCP servers are now available in EMET, so scientists who connect their Patsnap subscription can query drug, target, clinical, patent and literature data directly inside EMET. Previously, patent, clinical and competitive intelligence sat in separate systems from the environment where experiments are designed, and answering questions such as who else has filed on a target or what the clinical status of a compound class is meant leaving the workflow for a separate search. EMET supplies the biological evidence knowledge graph and orchestration layer that let its agents decide when Patsnap intelligence is relevant; the integration is available now but requires a Patsnap MCP subscription licensed directly through Patsnap.
BenchSci
Patsnap integration into EMET EMET agentic research environment Model Context Protocol
arXiv Nov 3, 2026
ToolSpace rebuilds agent training environments from real tool-call traces, lifting a 35B model's average score from 23.0 to 41.0 across seven benchmarks
ToolSpace reverses the order in which agent training environments are synthesized: it first mines data, state and retry dependencies between adjacent calls in execution traces from real MCP services and open agent corpora using deterministic rules, clusters the resulting weighted tool-composition graph into environments, synthesizes databases only where state is mutated, and then runs state-aware random walks with rollback to decompile replayable chains into natural-language tasks with assertion-based checks. Across seven long-horizon tool-use benchmarks, Qwen3.6-35B-A3B rises from 23.0 to 41.0 average score, or 43.2 with agent RL, and GLM-5.2 rises from 44.6 to 56.6.
ToolSpace reverses the order in which agent training environments are synthesized: it first mines data, state and retry dependencies between adjacent calls in execution traces from real MCP services and open agent corpora using deterministic rules, clusters the resulting weighted tool-composition graph into environments, synthesizes databases only where state is mutated, and then runs state-aware random walks with rollback to decompile replayable chains into natural-language tasks with assertion-based checks. Across seven long-horizon tool-use benchmarks, Qwen3.6-35B-A3B rises from 23.0 to 41.0 average score, or 43.2 with agent RL, and GLM-5.2 rises from 44.6 to 56.6.
ToolSpace Tool-Centric Environment Synthesis Long-horizon tool use Model Context Protocol AutomationBench Pro
arXiv Oct 25, 2026
Same tools, different interface: agent behavior shifts, and repairing only the expression lifts six settings by up to 9.0 points
With executable capabilities held fixed, presenting them as MCP tools or as CLI commands still sends language agents down different task trajectories. Built from a shared semantic action contract, the comparison spans six models and three interactive environments, and 94.3% of 2,004 paired episodes show structured divergence. DART, which repairs only the interface expression once a semantic decision is validated, raises benchmark score in all six benchmark–interface settings by up to 9.0 points and lowers MCP token cost in all three environments.
With executable capabilities held fixed, presenting them as MCP tools or as CLI commands still sends language agents down different task trajectories. Built from a shared semantic action contract, the comparison spans six models and three interactive environments, and 94.3% of 2,004 paired episodes show structured divergence. DART, which repairs only the interface expression once a semantic decision is validated, raises benchmark score in all six benchmark–interface settings by up to 9.0 points and lowers MCP token cost in all three environments.
Hong Kong Polytechnic University Chinese Academy of Sciences
Zhenning Shi（First author）Yongqi Li（Corresponding author）
MICA DART Model Context Protocol LLM Agents ALFWorld
Helical Oct 27, 2026
Biological foundation models move into Codex: natural-language prompts run perturbation experiments, with free compute for academics
Helical released a Model Context Protocol (MCP) integration for OpenAI's Codex that lets researchers call biological foundation models from the agentic tools they already use, and use or post-train those models on their own data through natural-language instructions. Using such models previously required researchers to configure infrastructure and build the workflows for an experiment. One model available at launch is PerturbGen, developed at the Wellcome Sanger Institute to predict how perturbations reshape cellular trajectories, and Helical with Nebius is offering free compute credits that academic researchers can request.
Helical released a Model Context Protocol (MCP) integration for OpenAI's Codex that lets researchers call biological foundation models from the agentic tools they already use, and use or post-train those models on their own data through natural-language instructions. Using such models previously required researchers to configure infrastructure and build the workflows for an experiment. One model available at launch is PerturbGen, developed at the Wellcome Sanger Institute to predict how perturbations reshape cellular trajectories, and Helical with Nebius is offering free compute credits that academic researchers can request.
Helical Wellcome Sanger Institute
Model Context Protocol Codex Biological foundation models PerturbGen
www.adyen.com Oct 22, 2026
Every AI coding tool keeps its own config: Adyen open-sources Agent Marketplace to compile one resource for eight tools
Adyen engineers have open-sourced Agent Marketplace, a command-line tool for sharing AI agent resources across teams, repositories and tools. Previously each AI coding tool kept its setup in its own folders, file formats and configuration fields, so instructions written for one tool rarely worked in another. The tool fetches resources listed in one configuration file, translates them into the format each tool expects and writes them where that tool looks, compiling a single resource for eight tools including Claude Code, Codex and Cursor, while a repeated sync changes nothing.
Adyen engineers have open-sourced Agent Marketplace, a command-line tool for sharing AI agent resources across teams, repositories and tools. Previously each AI coding tool kept its setup in its own folders, file formats and configuration fields, so instructions written for one tool rarely worked in another. The tool fetches resources listed in one configuration file, translates them into the format each tool expects and writes them where that tool looks, compiling a single resource for eight tools including Claude Code, Codex and Cursor, while a repeated sync changes nothing.
Agent Marketplace AI agent Model Context Protocol
HubZero Oct 17, 2026
Molecular dynamics without hand-written input files: ask for a material property in chat, and LAMMPS with UMA runs it and returns the error bar
nanoHUB has released MCP4MD, which connects LAMMPS and the UMA universal machine-learned potential to an AI assistant, so a user can describe a material property in natural language and have the calculation set up, run and read back. Previously such work meant installing software, writing input files and submitting queue scripts. Every number names the potential behind it and the reference it was fitted to, and arrives with error bars, units and qualifying warnings.
nanoHUB has released MCP4MD, which connects LAMMPS and the UMA universal machine-learned potential to an AI assistant, so a user can describe a material property in natural language and have the calculation set up, run and read back. Previously such work meant installing software, writing input files and submitting queue scripts. Every number names the potential behind it and the reference it was fitted to, and arrives with error bars, units and qualifying warnings.
Daniel Mejia（First author）
MCP4MD Molecular Dynamics UMA Model Context Protocol
arXiv Oct 14, 2026
In MCP tool choice, the parameter schema decides: rename one field and selection drops from nine in ten to one in ten
Among functionally similar MCP tools, the parameter schema shifts which tool a model picks more than names or descriptions do: renaming to as recipient_id cut selection of the same tool to 1–10% across five models.
University of Delaware University of South Florida
Xiaofan Li（First author）
LLM Tool Selection Model Context Protocol Conditional Logit Model