SecureMCP: Policy-Enforced Defense Against Prompt Injection in LLM-Generated SQL for AIoT Databases

Abstract

The deployment of Large Language Model (LLM)-generated SQL in Artificial Intelligence of Things (AIoT) systems introduces critical security risks, as prompt injection attacks can manipulate LLMs into producing unauthorized queries that expose sensitive data or execute destructive operations. Existing Natural Language to SQL (NL2SQL) research targets query accuracy, while current Model Context Protocol (MCP) servers offer only SQL-level protection without fine-grained, role-based access control. This paper proposes SecureMCP, a policy-enforced framework that integrates Role-Based Access Control (RBAC) with an MCP server to establish multi-layer defense for LLM-generated SQL execution. Grounded in an explicit threat model, the framework chains five defense modules in a sequential fail-closed pipeline addressing six prompt injection types spanning four adversary goals. We evaluate SecureMCP on the IoT-SQL dataset using Qwen3-8B, reporting filter performance—false positive rate (FPR) and false negative rate (FNR)—separately from LLM generation quality. On benign queries, the framework maintains a low false positive rate (0.3–2.2%) across four RBAC roles while keeping execution accuracy among allowed queries within 65.1–76.4%, matching the unprotected baseline of 63.8% and confirming that the defenses act as a transparent pre-execution filter. On 2400 adversarial queries, SecureMCP limits the effective false negative rate—computed over realized threats in which the injection payload was actually incorporated—to 3.98%, and an ablation confirms that RBAC and MCP-level defenses are complementary, as neither blocks the full range of injection vectors alone. The 72.5% injection incorporation rate confirms high LLM susceptibility, establishing the necessity of external policy enforcement.