发现MCP协议兼容性漏洞，可被用于隐蔽攻击
Compatibility at a Cost: Systematic Discovery and Exploitation of MCP Clause-Compliance Vulnerabilities
- 构建跨语言中间表示，统一分析多语言SDK
- 通过语义推理识别违规调用，定位3类可利用漏洞
- 适合安全研究人员和AI系统开发者参考
模型上下文协议（MCP）是一种新兴的互操作标准，用于统一AI代理与外部工具及数据源的连接方式。通过定义通用的客户端-服务器消息交换条款，MCP将原本碎片化的集成方式替换为标准化的即插即用框架。然而，为兼容多样化的AI代理，MCP规范将许多行为约束设为可选条款，导致其软件开发工具包（SDK）易被误用。我们识别出这一新攻击面，可使攻击者实现多种攻击（如静默提示注入、拒绝服务等），称之为“兼容性滥用攻击”。本文首次提出系统性框架，用于分析多语言MCP SDK中的该攻击面。首先，我们构建了一个通用且语言无关的中间表示（IR）生成器，对不同语言的SDK进行规范化。其次，基于新IR，提出由大语言模型引导的可审计静态分析方法，实现跨语言/条款的合规性检测。第三，通过形式化定义MCP条款的攻击语义，构建三种攻击模态，并开发模态引导的检测流水线，以发现可利用的不合规问题。
原文摘要 · Abstract (English)
The Model Context Protocol (MCP) is a recently proposed interoperability standard that unifies how AI agents connect with external tools and data sources. By defining a set of common client-server message exchange clauses, MCP replaces fragmented integrations with a standardized, plug-and-play framework. However, to be compatible with diverse AI agents, the MCP specification relaxes many behavioral constraints into optional clauses, leading to misuse-prone SDK implementation. We identify it as a new attack surface that allows adversaries to achieve multiple attacks (e.g, silent prompt injection, DoS, etc.), named as \emph{compatibility-abusing attacks}. In this work, we present the first systematic framework for analyzing this new attack surface across multi-language MCP SDKs. First, we construct a universal and language-agnostic intermediate representation (IR) generator that normalizes SDKs of different languages. Next, based on the new IR, we propose auditable static analysis with LLM-guided semantic reasoning for cross-language/clause compliance analysis. Third, by formalizing the attack semantics of the MCP clauses, we build three attack modalities and develop a modality-guided pipeline to uncover exploitable non-compliance issues.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。