为AI代理的外部接口设计安全访问控制框架
AgentBound: Securing Execution Boundaries of AI Agents
- 借鉴安卓权限模型，用声明式策略控制MCP服务器访问
- 自动分析源码生成策略准确率达80.9%，可防御多数恶意攻击
- 无需修改服务器代码，开销极小，适合开发者快速部署
大型语言模型已演变为能与外部工具和环境交互的AI代理。模型上下文协议（MCP）已成为连接代理与资源的事实标准，但安全防护滞后：数千个MCP服务器以无限制权限运行，构成广泛攻击面。本文提出AgentBound，首个针对MCP服务器的访问控制框架。该框架结合受安卓权限模型启发的声明式策略机制与无需修改MCP服务器的策略执行引擎，实现恶意行为隔离。我们构建了包含296个最流行MCP服务器的数据集，证明可从源码自动生成策略，准确率达80.9%。实验显示AgentBound有效阻断多个恶意MCP服务器的威胁，且策略执行引擎引入的性能开销可忽略。本工作为开发者和项目管理者提供安全加固基础，同时推动声明式访问控制与MCP安全的新研究方向。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol (MCP) has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers execute with unrestricted access to host systems, creating a broad attack surface. In this paper, we introduce AgentBound, the first access control framework for MCP servers. AgentBound combines a declarative policy mechanism, inspired by the Android permission model, with a policy enforcement engine that contains malicious behavior without requiring MCP server modifications. We build a dataset containing the 296 most popular MCP servers, and show that access control policies can be generated automatically from source code with 80.9% accuracy. We also show that AgentBound blocks the majority of security threats in several malicious MCP servers, and that the policy enforcement engine introduces negligible overhead. Our contributions provide developers and project managers with a foundation for securing MCP servers while maintaining productivity, enabling researchers and tool builders to explore new directions for declarative access control and MCP security.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。