Automated Cybersecurity Detection Framework Based on Model Context Protocol and Large Language Models

Abstract

This study presents an intelligent cybersecurity detection framework that integrates Large Language Models (LLMs) with the Model Context Protocol (MCP) to reduce the operational complexity of traditional tools and enhance automation. The proposed system enables agents to invoke external security tools, perform threat detection, and generate structured, readable analysis reports. A two-stage security assessment mechanism, powered by LLMs, conducts multi-dimensional risk evaluations to block high-risk or malicious commands, ensuring system safety. Key features include a natural language interface, real-time automated detection, structured reporting for improved decision-making, and modular extensibility via MCP integration. Experimental results show that the framework effectively automates security workflows and enhances both usability and system reliability.