MCP协议虽便利，却藏严重安全漏洞，可被恶意利用攻破系统。
MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits
- 用多智能体自动探测MCP服务器的攻击样本和漏洞
- 实测证明主流LLM可被诱导执行恶意代码、窃取凭证
- 提供首个MCP安全审计工具，适合开发者部署前自查
为降低开发负担并实现生成式AI组件间的无缝集成，模型上下文协议（MCP，Anthropic, 2024）近期发布并被广泛采用。MCP是一种开放协议，标准化了大语言模型（LLMs）、数据源和代理工具的API调用。通过连接多个配置了工具、资源和提示的MCP服务器，用户可定义完全由LLM驱动的自动化工作流。然而，我们发现当前MCP设计对终端用户存在广泛的安全风险。特别地，我们演示了行业领先的大语言模型可能被诱导使用MCP工具，实施恶意代码执行、远程访问控制及凭证窃取等攻击。为主动缓解此类及类似攻击，我们提出首个用于评估任意MCP服务器安全性的智能体工具——MCPSafetyScanner。该工具通过多个智能体实现：(a) 在给定MCP服务器的工具与资源下自动生成对抗样本；(b) 基于这些样本搜索相关漏洞与修复方案；(c) 生成包含所有发现的安全报告。本工作揭示了通用代理工作流的重大安全隐患，同时提供一种主动审计手段，可在部署前识别并修复漏洞。所提出的MCP服务器审计工具MCPSafetyScanner已开源：https://github.com/johnhalloran321/mcpSafetyScanner。
原文摘要 · Abstract (English)
To reduce development overhead and enable seamless integration between potential components comprising any given generative AI application, the Model Context Protocol (MCP) (Anthropic, 2024) has recently been released and subsequently widely adopted. The MCP is an open protocol that standardizes API calls to large language models (LLMs), data sources, and agentic tools. By connecting multiple MCP servers, each defined with a set of tools, resources, and prompts, users are able to define automated workflows fully driven by LLMs. However, we show that the current MCP design carries a wide range of security risks for end users. In particular, we demonstrate that industry-leading LLMs may be coerced into using MCP tools to compromise an AI developer's system through various attacks, such as malicious code execution, remote access control, and credential theft. To proactively mitigate these and related attacks, we introduce a safety auditing tool, MCPSafetyScanner, the first agentic tool to assess the security of an arbitrary MCP server. MCPScanner uses several agents to (a) automatically determine adversarial samples given an MCP server's tools and resources; (b) search for related vulnerabilities and remediations based on those samples; and (c) generate a security report detailing all findings. Our work highlights serious security issues with general-purpose agentic workflows while also providing a proactive tool to audit MCP server safety and address detected vulnerabilities before deployment. The described MCP server auditing tool, MCPSafetyScanner, is freely available at: https://github.com/johnhalloran321/mcpSafetyScanner
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。