为大模型工具调用添加安全准入机制，防止未知服务器滥用权限。
Attested Tool-Server Admission: A Security Extension to the Model Context Protocol
- 通过签名声明文件和可信根验证，确保服务器身份可信。
- 默认拒绝所有工具，仅允许白名单内工具调用，降低风险。
- 支持强制拦截与审计日志，适合高安全场景使用。
大语言模型代理与外部工具服务器之间的通信标准（MCP）虽统一了消息交换格式，但未解决信任问题：主机依赖服务器自报的工具列表，无法判断其可用性、敏感度或工具范围。本工作源于让Enclawed代理安全使用Google的MCP服务器（如Gmail、Calendar、Drive）的需求，目标是在不修改MCP或Enclawed API的前提下，实现服务器准入与工具调用边界控制。为此构建mcp-attested机制，包含三项核心设计：（1）服务器在固定URI发布离线签名的清关声明，主机通过预置信任根验证；（2）基于服务器的默认拒绝工具白名单，承认服务器不等于信任其全部工具；（3）可选强制执行模式，将检查转为硬性拒绝，并将每项决策写入防篡改审计日志。本文提供协议格式、验证算法、安全分析及LLM驱动的对抗评估，并以规范化的RFC 2119形式定义标准：包括架构、验证规则、错误注册表、通用注册位置和机器可验证合规向量，便于作为MCP扩展被采纳。未扩展的主机忽略该文档，行为与现有系统完全一致。
原文摘要 · Abstract (English)
The Model Context Protocol (MCP) standardizes how a large-language-model (LLM) agent and an external tool server exchange messages, but not trust: a host reads a server's self-declared tool list and dispatches calls, with no notion of which servers it may use, at what sensitivity, or which of a server's tools are in bounds. This work grew out of a concrete need -- letting the Enclawed agent use Google's externally-operated MCP servers (Gmail, Calendar, Drive) safely, admitting the server and bounding the tools it may drive, without changing MCP or Enclawed's own tool application-programming interface (API). The mechanism we built, mcp-attested (shipped in both the open enclawed-oss distribution and the enclaved flavor), generalizes: the gap that makes an unmediated third-party connection unsafe for one user makes a regulated deployment impossible to accredit. We close it with three additive mechanisms: (1) a small, offline-signed clearance assertion a server publishes at a well-known Uniform Resource Identifier (URI) and a host verifies against a pinned trust root before any tool dispatch; (2) a deny-by-default per-server tool allowlist, so admitting a server is not trusting its every tool; and (3) a flavor-gated enforcement mode that turns the checks from warnings into hard denials, with every decision written to a tamper-evident audit log. We give the wire format, the verification algorithm, a security analysis, and an LLM-driven adversarial evaluation; we then state the design in normative Request-for-Comments (RFC 2119) form -- schema, verification rules, error registry, well-known registration, and machine-checkable conformance vectors -- so it can be adopted as an MCP addendum rather than reinvented. An unextended host ignores the well-known document and behaves exactly as today.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。