MCP tool calls pass individual checks, then break the session

Individual MCP tool calls can pass every check and still break the authorization a session was granted, per a new paper on MCP authorization checking. The previous strongest safeguard, a checker that tracks call history, still missed 509 of 1,008 attacks in the paper's own benchmark. Anyone running multi-step MCP agent sessions inherits that blind spot until their checks track the whole workflow, not each call.

The paper's fix, called Runtime Authorization Consistency Checking, treats authorization as state instead of a per-call yes or no. It carries forward whatever a session's accepted calls have already established. Each new call is checked against that inherited basis, not against its own request in isolation.

Reject a step and it drops out of the lineage, so nothing later can build on a call that never should have counted.

That baseline comes from a 1,248-workflow benchmark called TraceBench, built to test static rules plus call-history tracking against sequence-based attacks. RAC missed zero attacks on the same suite.

Tested against workflows an LLM generated rather than hand-built, RAC reached 92.8% block recall against the baseline's 68.8%. It ran the check in sub-millisecond p99 latency.

Per-call permission checks can't catch this failure, because they never see the authority a session accumulates across separately approved steps. The open question for anyone running multi-step MCP agent sessions is whether their guardrails track the call or the session.