Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control

arXiv:2605.18414v2 Announce Type: replace-cross Abstract: Large language models increasingly operate as autonomous agents that select and invoke tools from large registries. We identify a critical gap: when unauthorized tools are visible in an agent's context, models select them in adversarial scenarios even when explicitly instructed otherwise. We evaluate three models (Qwen 2.5 7B, Llama 3.1 8B, and Claude Haiku 3.5) on 200 adversarial tasks across four attack categories. Under unfiltered conditions, unauthorized invocation rate (UIR) ranges from 48.5% to 68.5%. Explicit prompt-based allowlists reduce UIR, but leave model-dependent failure rates ranging from 4.0% to 37.0%. We propose a governed MCP proxy that enforces attribute-based access control at tool discovery and invocation time. By removing unauthorized tools before they enter the model context and independently checking calls at invocation, the governed condition achieves 0% UIR across all tested models and attack categories, with a measured median overhead of 1.72ms in our controlled environment. These results demonstrate the importance of architectural enforcement rather than relying on probabilistic prompt compliance for agentic tool access control.