When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling
This paper surveys how AI agents using MCP, skills, and tool calling become much riskier when they can sign and execute Web3 actions, because blockchain properties like irreversibility, delegated signing authority, autonomous operation, and composable transaction sequences turn ordinary agent failures into potentially permanent asset loss. Its main contribution is a Web3-specific attack-surface taxonomy and risk-mapping matrix that connects MCP/tool attacks to blockchain-amplified impacts and mitigations, though it appears primarily synthetic rather than a new measurement or defense system, and its conclusions depend on the completeness and comparability of the fragmented security literature it organizes.
Abstract
AI agents increasingly act rather than merely read: across the Model Context Protocol (MCP) ecosystem, the share of deployed tools that modify external state has risen from 27% to 65% of tool use. When agents exercise this authority on public blockchains through MCP, skills, and tool calling, the consequences of an attack are governed by the blockchain execution layer rather than by conventional software assumptions. This survey argues that four properties of that layer (irreversibility, signing authority, continuous autonomy, and sequence-level composition) qualitatively change the threat model, turning the recoverable failures of generic agent security into a standing, irreversible loss. We organize the fragmented MCP-security literature into an attack-surface taxonomy, then contribute a Web3 risk-mapping matrix that ties each attack class to its amplified impact, the responsible amplifiers, a representative mitigation, and the residual gap. We synthesize defenses, including emerging blockchain-based mechanisms, and find them improving but insufficient: measured protections stop fewer than 30% of attacks, and model-level safety refuses fewer than 3%. We close by positioning the work against adjacent surveys and deriving a research agenda from the matrix's open cells.