Abstract

The Model Context Protocol is an open source standard that allows AI agents to connect to external tools, databases, and services. While this connection is seamless, it also enables a class of multi-step attacks that existing per-call defenses have a gap in their mechanism to detect. Against undefended systems, these attacks achieve over 90% success rates by composing individually innocent tool calls into malicious sequences [5]. Existing MCP defenses evaluate each invocation in isolation and have no mechanism to detect intent that only becomes visible across a session. This paper presents ChainWatch, a sequential detection framework designed for this threat class. ChainWatch models attack progression as a six-stage MCP kill chain, classifies tool-call sequences using a Hidden Markov Model, and fires detection rules when a session pattern matches a suspicious progression pattern. The framework is grounded in a structured threat analysis covering three multi-step attack categories Direct Sequential Attacks, Indirect Injection Chains, and Hybrid Multi-Stage Attacks. It operationalises these through a 20dimensional feature extraction schema derived from documented attack behaviour. We trace the framework through five scenarios drawn from the security research literature, demonstrating how ChainWatch would detect attack chains that pass per-call inspection by existing MCP defenses.