A team of researchers has built a policy enforcement layer designed to stop AI agents from abusing the tools they call through the Model Context Protocol.
The Model Context Protocol, or MCP, is an open-source standard that lets large language models call external tools and services. Researchers found that a poorly-behaved or malicious agent can request oversized parameters, like huge search radii or excessively long videos, and drag down performance for everyone else on the same backend. The paper's authors argue that text, image, video, and location tools each open different abuse paths, which makes writing one clean rule book hard. Their fix, called AEGIS, uses an LLM to read incoming tool calls, sort them into categories, and translate them into a standard format that a policy engine can check.
AEGIS plugs into two existing pieces of infrastructure: the Open Policy Agent, a widely used authorization engine, and the ContextForge AI Gateway, which routes MCP traffic. That combination lets administrators write one set of resource limits that apply across wildly different tool schemas instead of hand-coding rules for every API.
MCP adoption is moving faster than the security tooling meant to police it, and this paper is an early attempt to close that gap before enterprises get burned by an agent that quietly turns a search tool into a denial-of-service vector.