ContractGuard: Auditing Semantic Contracts of MCP Tools for Security Violations

Model Context Protocol (MCP) is rapidly emerging as a standard interface for connecting large language model (LLM) applications to external tools. An MCP tool exposes two semantic views of the same functionality: a developer-provided description that guides the LLM's tool selection, and an implementation that determines the actual runtime behavior. Security issues arise when these two views diverge, leading to instruction injection, misleading descriptions, malicious code, or unsafe implementations. Existing defenses analyze descriptions or implementations largely in isolation, and thus, fail to address this broader threat space in a unified manner.

We present ContractGuard, the first security-oriented framework for bidirectional semantic contract auditing of MCP tools. Our observation is that diverse MCP threats can be unified as violations of a semantic contract between a tool's description and its implementation. ContractGuard combines reachability-aware static analysis with LLM-based cross-view reasoning for auditing. It extracts a tool-specific code slice, generates a code-grounded description, compares it against the developer-provided one, and validates and classifies detected inconsistencies. We evaluate our method on 3,586 MCP tools from 1,000 real-world MCP servers and 5,661 benchmark cases. Our tool uncovers 116 security issues in the wild, including 21 misleading descriptions, 29 instances of potentially malicious code, and 66 unsafe implementations. It achieves 96.0% true positive rate on malicious-code benchmarks, and more than 92.8% true positive rate on description-attack benchmarks. Results show that contract auditing can effectively identify securityrelevant description-implementation mismatches in MCP tools.