MCP系统身份混淆风险大，一次授权可能让多个未认证调用者访问敏感工具。
Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems
- 发现MCP服务器依赖持久授权状态，不验证每次调用者身份
- 多数服务器未在工具级别强制认证，导致越权访问
- 适合关注AI代理安全的开发者与研究人员阅读
Model Context Protocol（MCP）是一种开放标准接口，使大型语言模型（LLMs）能与外部工具和服务交互，正被越来越多AI代理采用。然而，MCP系统的安全性尚未得到充分研究。本文对集成在MCP客户端中的MCP服务器进行了大规模安全分析，发现将MCP服务器视为可信实体而不验证调用者身份本质上是不安全的。由于MCP服务器通常无法区分请求来源，单次授权可能隐式授予多个潜在不可信调用者访问权限。实证研究表明，大多数MCP服务器依赖持久授权状态，初始授权后无需重新认证即可执行工具调用，且不区分调用者。此外，许多服务器未能在工具级别强制执行认证，导致对敏感操作的未授权访问。这些发现表明，一次性授权和服务器级信任显著扩大了MCP系统的攻击面，亟需显式调用者认证和细粒度授权机制。
原文摘要 · Abstract (English)
The Model Context Protocol (MCP) is an open and standardized interface that enables large language models (LLMs) to interact with external tools and services, and is increasingly adopted by AI agents. However, the security of MCP-based systems remains largely unexplored.In this work, we conduct a large-scale security analysis of MCP servers integrated within MCP clients. We show that treating MCP servers as trusted entities without authenticating the caller identity is fundamentally insecure. Since MCP servers often cannot distinguish who is invoking a request, a single authorization decision may implicitly grant access to multiple, potentially untrusted callers.Our empirical study reveals that most MCP servers rely on persistent authorization states, allowing tool invocations after an initial authorization without re-authentication, regardless of the caller. In addition, many MCP servers fail to enforce authentication at the per-tool level, enabling unauthorized access to sensitive operations.These findings demonstrate that one-time authorization and server-level trust significantly expand the attack surface of MCP-based systems, highlighting the need for explicit caller authentication and fine-grained authorization mechanisms.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。