Park jung-kyu
														|
													
												
													
														Youngmi Baek
														
													
												
												
												
												| 2025, 11(5)
												
													
														| 3
													
													
												
												| number of Cited : 0
											
											
											
												
												
													
														
															
																
																	
																		The rapid advancement of large language models (LLMs) has highlighted the Model Context Protocol (MCP) as a new standard for tool integration. However, security vulnerability research in MCP environments remains insufficient. This study presents one of the first experimental applications of fuzzing in MCP environments, targeting two representative modules: a SQLite-based query engine and a file system (FS) interface. To this end, customized fuzzing harnesses were developed to systematically generate diverse payloads, and performance metrics were collected over 30-minute experiments. The results indicate that the SQL-based server produced 77,758 test cases with greater payload diversity and longer average payload lengths, whereas the FS-based server produced 47,520 cases with shorter and simpler payloads. Notably, the response rate showed a clear disparity, with SQL fuzzing achieving approximately three times higher response success compared to FS fuzzing. These findings suggest that fuzzing characteristics  and security robustness vary significantly depending on the target tool type within MCP environments. Overall, this study provides an early systematic evaluation of fuzzing-based vulnerability detection in MCP environments, offering foundational insights to strengthen the security of MCP-based applications.