Securing Multi-Agent Systems in Healthcare

Who Do You Trust? Securing Multi-Agent MCP Systems in Healthcare - Yuvraj Pradhan, MIT ADT University & Archana Kumari, MIT ADT University An LLM caught my friend’s condition that doctors took two months to confirm. We asked: what happens when multiple specialised models review the same case together? We built ConsensusMed on MCP. Each specialist model for a medical domain runs as an independent MCP server, and an orchestrator coordinates their outputs and decides what to trust when models disagree. Multi-agent clinical systems face real attack surfaces: - A malicious MCP server can exfiltrate OAuth tokens and impersonate legitimate users - Prompt injection in clinical reports silently shifts outputs before consensus - Tampered model weights corrupt findings with no OAuth scope catching it So we built a trust layer directly into MCP: - An MCP interceptor proxy redacts PHI using NER before any tool call reaches a specialist server - The chairman verifies SHA-256 hashes of model weights against Ed25519-signed manifests before spawning - Specialists run as stdio subprocesses. They never bind to a port. Network access is structurally impossible. For regulated environments, we built an air-gapped MCP registry that operates entirely offline with cryptographic verification before execution.