ContextGuard-MCP-PQC | Post-Quantum Security for MCP

Abstract

Reproduced from the accepted manuscript. The full paper text is not hosted in this repository or on this site — only the abstract and citation are published pre-indexing, per IEEE prior-publication policy.

Abstract The proliferation of Model Context Protocol (MCP) as the operative authentication and tool invocation fabric for enterprise agentic AI systems has introduced a cryptographic trust surface that remains unexamined through the post-quantum security lens. This paper presents the first systematic application of RFC 9794's Post-Quantum/Traditional (PQ/T) hybrid terminology standard to MCP's four security-relevant layers: host authentication, transport channel confidentiality, server and tool identity certification, and tool result integrity. Three novel vulnerability classes are identified: MCP transport channels contain no normative reference to hybrid Key Encapsulation Mechanism design; MCP server identity relies exclusively on single-algorithm X.509 certificates, exposing tool authentication to harvest-now-decrypt-later (HNDL) adversaries; and tool result signing uses traditional digital signatures with no PQ/T hybrid equivalent. The ContextGuard-MCP-PQC governance framework is proposed as the structured response: a four-layer control architecture aligned to NIST CSF 2.0 and COBIT 2019, providing enterprise practitioners with a phased PQC migration roadmap.

Index Terms post-quantum cryptography, Model Context Protocol, RFC 9794, hybrid key encapsulation, agentic AI security, ContextGuard, HNDL, PKI migration, NIST CSF 2.0

Framework Architecture

Four controls, each mapped to an MCP security layer and the RFC 9794 hybrid construct that addresses it.

Layer 1 · Host Authentication

HAF — Hybrid Authentication Floor

Enforces a minimum PQ/T hybrid digital signature requirement (ML-DSA + ECDSA) for agent credential presentation, with Traditional-Only, Hybrid-Preferred, and Hybrid-Required enforcement tiers.

Layer 2 · Transport Channel

HKF — Hybrid KEM Floor

Inspects TLS cipher suite negotiation for a PQ/T composite KEM (X25519+ML-KEM-768) and blocks classical-only fallback under Hybrid-Required enforcement, implementing RFC 9794 downgrade protection.

Layer 3 · Server / Tool Identity

HRS — Hybrid Readiness Score

A 0–5 quantitative certificate chain quantum-posture metric per MCP endpoint, driving a migration priority queue rather than a binary pass/fail.

Layer 4 · Tool Result Integrity

RSP — Result Signature Policy

Validates hybrid signatures on tool result payloads (Unsigned / Signed-Require-Traditional / Signed-Require-Hybrid), preventing AI agents from acting on unverified or forged results.

Governance Mapping

Each control maps to NIST CSF 2.0 and COBIT 2019, enabling direct integration into existing enterprise audit and governance structures.

Control	NIST CSF 2.0	COBIT 2019
HAF — Agent Identity	GV.PO-01, PR.AA-01	APO12.02, DSS05.04
HKF — Transport	PR.DS-02, PR.DS-10	DSS05.03, BAI10.01
HRS — Certificate	DE.CM-01, GV.RM-04	APO12.06, BAI10.03
RSP — Result Provenance	DE.CM-06, RS.AN-03	DSS05.07, APO12.04

Repository Contents

Open-source implementation artifacts: PoC demonstrations, benchmarks, and risk scoring. No manuscript files are hosted in this repository.

contextguard-mcp-pqc/
├── poc/
│   ├── hndl_demo.py          Harvest-Now-Decrypt-Later threat simulation
│   └── downgrade_demo.py     TLS cipher suite downgrade attack demo
├── benchmarks/
│   └── pqc_bench.py          ML-KEM / ML-DSA performance benchmarks
├── risk/
│   ├── risk_assessment.py    Quantitative vulnerability risk scoring
│   └── risk_report.json      Scored output (V1-V4 vulnerability classes)
├── framework/
│   ├── haf.py                Hybrid Authentication Floor
│   └── hrs.py                Hybrid Readiness Score calculator
├── audit_docx.py             IEEE manuscript layout/style QA tool
├── CITATION.cff
├── LICENSE
└── README.md

Authors

Sunil GentyalaIndependent Researcher / HCLTech America Inc., Dallas TX, USA · IEEE Senior Member

P. Krishna SunilNarasaraopeta Engineering College, India

Vamshi LandeUniversity of North Texas, Denton TX, USA

Akhila KasturiHCLTech, Dallas TX, USA

Suresh Kumar DarisiRocket Software Inc., Boston, USA

Ruhisulthana ShaikSir C.R. Reddy Polytechnic College, Eluru, India

Citation

Formal IEEE Xplore citation and DOI will be added once the paper is indexed. Cite the software / preprint using the entry below until then.

@inproceedings{gentyala2026contextguard_pqc,
  title     = {Post-Quantum Security Framework for Model Context Protocol Using ContextGuard},
  author    = {Gentyala, Sunil and Krishna Sunil, P. and Lande, Vamshi
               and Kasturi, Akhila and Darisi, Suresh Kumar and Shaik, Ruhisulthana},
  booktitle = {2026 6th International Conference on Soft Computing for
               Security Applications (ICSCSA)},
  publisher = {IEEE},
  year      = {2026},
  note      = {Paper ICSCSA-011. Accepted; pending IEEE Xplore indexing.},
  url       = {https://github.com/sunilgentyala/contextguard-mcp-pqc}
}