用内核级安全机制守护AI工具调用，防绕过、可审计。
Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives
- 在内核层构建多层工具调用拦截网，基于逻辑值判断实现语义安全检测。
- 单次调用开销仅11.3微秒，安全检测速度比现有方案快2.4-3.4倍。
- 可防御10行脚本绕过，适合高安全性AI系统开发者使用。
AI代理通过模型上下文协议（MCP）调用外部工具（如文件系统、网络、API），这些操作如同系统的特权指令，对共享状态有副作用。然而当前的安全防护全在用户空间，10行脚本即可绕过。本文提出Governed MCP，一种基于逻辑值安全原语（ProbeLogits）的内核级工具治理网关。该网关通过六层流水线拦截每个MCP工具调用：模式验证、信任层级、速率限制、对抗预过滤、一个基于ProbeLogits的语义门（核心检查），以及宪法策略匹配，并生成Blake3哈希审计链。在约28.6万行Rust代码的Anima OS裸金属x86-64内核中实现。前五层加审计附加开销为每调用11.3微秒；ProbeLogits门（一次提示探测填充+单次逻辑值读取）在Qwen2.5-7B、Llama-3-8B和Mistral-7B上分类耗时332-556毫秒，比相同硬件下Llama Guard 3快2.4-3.4倍。硅片实测消融实验显示，移除ProbeLogits层后F1从0.789降至0.357（ΔF1 = -0.432），表明仅靠规则防火墙不足。所有WASM到系统主机函数及注册的MCP工具均由内核网关控制，使现有护航库可被10行脚本绕过的漏洞在结构上不可能发生；部分ring-3系统调用路径暂未受控，留待后续工作。跨三类架构（HarmBench 98-99%非版权阻断，XSTest 98.5-100%不安全召回，ToxicChat与Llama Guard 3相当）的多模型验证表明该原语具备架构无关性。结果证明，工具调用治理可作为操作系统原语实现，而非仅应用层问题。
原文摘要 · Abstract (English)
AI agents increasingly call external tools (file system, network, APIs) through the Model Context Protocol (MCP). These tool calls are the agent's syscalls: privileged operations with side effects on shared state, yet today's safety enforcement lives entirely in userspace, where a 10-line script can bypass it. I propose Governed MCP, a kernel-resident tool governance gateway built on a logit-based safety primitive (ProbeLogits). The gateway interposes on every MCP tool call in a 6-layer pipeline: schema validation, trust tier, rate limit, adversarial pre-filter, a ProbeLogits semantic gate (the load-bearing check), and constitutional policy match, with a Blake3-hashed audit chain. I implement Governed MCP in Anima OS, a bare-metal x86-64 kernel in ~286,000 lines of Rust. The five non-inference layers plus the audit append cost a measured 11.3 us per call; the ProbeLogits gate (one probe-prompt prefill plus a single logit read) costs 332-556 ms per classification across Qwen2.5-7B, Llama-3-8B, and Mistral-7B, 2.4-3.4x faster than a Llama Guard 3 pass on the same hardware. A silicon-measured ablation shows that removing the ProbeLogits layer collapses F1 from 0.789 to 0.357 (delta-F1 = -0.432): hand-rule firewalling alone is insufficient. Every WASM-to-system host function and every registered MCP tool is mediated by the kernel gateway, so the 10-line userspace bypass that defeats existing guardrail libraries is structurally impossible; a disclosed set of ring-3 syscall paths remains ungated pending future work. Multi-model validation across three architectures (HarmBench 98-99% non-copyright block, XSTest 98.5-100% unsafe recall, ToxicChat parity with Llama Guard 3) shows the underlying primitive is architecture-agnostic. Governed MCP demonstrates that tool-call governance is feasible as an OS primitive, not just an application-layer concern.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。