Unbounded MCP Tool Calls

Model Context Protocol servers expose tools without rate, depth, or blast-radius limits, enabling recursive or fan-out abuse.

Open in the interactive atlas →

Impact

Runaway tool loops burn budget, overwhelm backends, and amplify a single injection into multi-system damage.

Why this severity

Impact Medium × Likelihood Medium = Medium

Impact medium: cost and availability loss, usually recoverable. Likelihood medium: runaway loops are common operationally; deliberate abuse is documented for stolen cloud LLM access rather than MCP specifically.

Impact Medium: Limited or recoverable harm: cost, availability, reputational damage, or exposure confined to one session or user.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Incident: LLM Jacking (MITRE ATLAS case study AML.CS0030, 2024)

Exploits

Excessive Tool Permissions Vulnerability · Critical severity

Leads to

Dynamic Code Execution Vulnerability · High severity

Mitigated by

MCP Permission Scoping Guardrail · Fixes critical risks

Remediation

Enforce per-session call budgets and maximum recursion depth.
Circuit-break on repeated identical tool invocations.
Scope MCP servers to least-privilege resource sets.

How to verify

Load-test agent loops against a mock MCP server with budget counters.
Confirm circuit breakers trip before backend SLOs are breached.

Pattern

const budget = session.toolBudget;
if (budget.remaining <= 0) return deny('budget');
budget.consume(1);

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM10:2025 Unbounded Consumption
LLM06:2025 Excessive Agency

OWASP Top 10 for Agentic Applications 2026

ASI08:2026 Cascading Failures

MITRE ATLAS

AML.T0034.002 Cost Harvesting: Agentic Resource Consumption
AML.T0029 Denial of AI Service

NIST AI RMF 1.0

MEASURE 2.7 AI system security and resilience are evaluated and documented