ToFu study finds 253 security bugs across 118 open-source MCP servers

ToFu is an arXiv paper (2610.13651, submitted 9 October 2026) by Md Nazmul Islam Ananto, Arslan Khan and four co-authors, and it has not been peer reviewed. It tests the gap between what an AI agent's tools promise to accept and what they actually check, since arguments written by the model are often passed straight through as if trusted. ToFu reads each tool's existing metadata, derives security checks from a corpus of common weakness types, and automatically builds fuzzing tests. Run against 273 open-source MCP servers with 3,405 tools, the authors report 253 verified semantic security bugs in 118 of the servers; the abstract counts 343 affected tools. Their conclusion is that real-world tools often fail to enforce their own documented input rules. These are the authors' results.