---
title: ToFu: fuzzing MCP tools from their own metadata finds verified bugs in 343 tools across 118 servers | ctxsec
url: https://ctxsec.com/items/tofu-mcp-tool-fuzzing
description: ""
status: "research (preprint)"
published: 2026-10-14
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/tofu-mcp-tool-fuzzing.md)

research (preprint)

2026-10-14

### ToFu: fuzzing MCP tools from their own metadata finds verified bugs in 343 tools across 118 servers

An arXiv preprint (Penn State, Dartmouth, Montpellier) treats every LLM-generated tool argument as untrusted and turns each tool's own description into security checks plus fuzzing harnesses. Across 273 runnable open-source MCP servers (3,405 tools) it reports 253 hand-verified bugs in 343 tools on 118 servers: mostly reflected output (115), path traversal (64) and log injection (58), plus SSRF, data exfiltration and command injection. The authors also show a "Repeat-After-Me" trick: asking a model to repeat tool-call text verbatim gets the orchestrator to dispatch it, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Takeaway: tools must validate their own inputs rather than trust the model or harness. Not peer-reviewed yet.

Sources: [arXiv 2610.13651](https://arxiv.org/html/2610.13651)