ShieldNet: Network-Level Guardrails against Emerging Supply Chain Injection in Agent Systems

Researchers propose a network-level guardrail framework, ShieldNet, that detects supply chain poisoning in agent systems by monitoring real network interactions rather than surface-level tool traces. Addressing the emerging supply chain threat in which agents increasingly rely on third-party tools and MCP servers, and malicious behavior is embedded in seemingly benign tools to hijack execution, leak data or trigger unauthorized actions, the authors built the SC-Inject-Bench benchmark containing more than 10,000 malicious MCP tools, whose attack taxonomy covers more than 25 attack categories derived from MITRE ATT&CK. Existing MCP scanners and semantic guardrails perform poorly on this benchmark. ShieldNet integrates a man-in-the-middle (MITM) proxy and an event extractor to identify key network behaviors, and then a lightweight classifier completes attack detection. Experiments show that its F-1 reaches up to 0.995 with a false positive rate of only 0.8%, with low runtime overhead, significantly outperforming existing MCP scanners and LLM-based guardrails.