The evolution of Large Language Models (LLMs) into Agentic AI has established the Model Context Protocol (MCP) as the standard for connecting reasoning engines with external tools. Although this decoupled architecture fosters modularity, it simultaneously shatters the traditional trust boundary. We uncover a novel privacy vector inherent to this paradigm: the Intent Inversion Attack. We show that semi-honest third-party MCP servers can accurately reconstruct users' underlying intents by leveraging only authorized metadata (e.g., function signatures, arguments, and receipts), effectively bypassing the need for raw query access. To quantify this threat, we introduce IntentMiner. Unlike statistical approaches, IntentMiner employs a hierarchical semantic parsing strategy that performs step-level intent reconstruction by analyzing tool functions, parameter entities, and result feedback in an orthogonal manner. Experiments on the ToolACE benchmark reveal that IntentMiner achieves a semantic alignment of over 85% with original queries, substantially surpassing LLM baselines. This work exposes a critical endogenous vulnerability: without semantic obfuscation, executing functions requires the transparency of intent, thereby challenging the privacy foundations of next-generation AI agents.

翻译：大型语言模型（LLM）向智能体AI的演进，确立了模型上下文协议（MCP）作为连接推理引擎与外部工具的标准。尽管这种解耦架构促进了模块化，但它同时打破了传统的信任边界。我们发现该范式固有的一个新型隐私泄露途径：意图反演攻击。我们证明，半诚实的第三方MCP服务器仅利用授权的元数据（例如函数签名、参数和回执），即可准确重构用户的潜在意图，从而有效规避对原始查询访问的需求。为量化此威胁，我们提出了IntentMiner。与统计方法不同，IntentMiner采用分层语义解析策略，通过以正交方式分析工具函数、参数实体和结果反馈，执行步骤级的意图重构。在ToolACE基准测试上的实验表明，IntentMiner与原始查询的语义对齐度超过85%，显著超越了LLM基线。这项工作揭示了一个关键的内生性漏洞：若无语义混淆，执行函数即需意图透明，从而对下一代AI代理的隐私基础构成挑战。