为MCP式智能体运行时设计可验证的安全守恒，防止权限滥用。
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
- 通过主件、资源、授权等机制显式定义执行层安全规则
- 在10个测试用例中完全阻断攻击，且保留审计证据
- 适合关注智能体系统安全的开发者和架构师
Model Context Protocol（MCP）式生态为语言模型应用提供了工具、资源、提示和传输的实用连接层。当智能体从连接进入执行阶段时，安全决策常分散于客户端、服务端、提示、审批对话、OAuth部署和日志中。本文探讨运行时是否能在保持MCP式工作流的前提下，使执行层安全守恒显式且可测试。我们定义了八项守恒：元数据无权限、授权背书审批、规范资源、主体绑定、作用域能力调用、源与目标数据流授权、拒绝路径审计、显式协议状态。在HCP（Handle-Capability Protocol）参考运行时中实现这些守恒，其通过主体、资源、授权、能力、句柄、策略决策、数据管道检查和审计条目表示调用。在两个MCP类似基线（朴素连接层运行时与实践导向的缓解基线，含元数据校验、会话检查和每调用审批）上评估，10个基准案例中，朴素基线允许全部攻击，缓解基线允许6个，而HCP阻止全部10个，同时保留审计证据。消融实验识别出各组件对防御的作用。本地内存微基准显示策略、调用、窥探和管道操作平均延迟低于1毫秒。一个受限的GitHub README筛查样本提供生态信号，而非漏洞发现。结果支持一个有限结论：MCP式智能体系统需在连接层规范之外增加执行控制层。
原文摘要 · Abstract (English)
Model Context Protocol (MCP)-style ecosystems give language-model applications a practical connection layer for tools, resources, prompts, and transports. As agents move from connection to execution, security decisions often remain split across clients, servers, prompts, approval dialogs, OAuth deployments, and logs. This paper asks whether a runtime can make execution-layer invariants explicit and testable while preserving MCP-like workflows. We define eight invariants: metadata non-authority, grant-backed approval, canonical resources, principal binding, scoped capability invocation, source-and-target data-flow authorization, deny-path audit, and explicit protocol state. We implement these invariants in HCP, a Handle-Capability Protocol reference runtime for MCP-style agent execution that represents calls through principals, resources, grants, capabilities, handles, policy decisions, data-pipe checks, and audit entries. We evaluate HCP against two MCP-like baselines: a naive connection-layer runtime and a practice-informed connection-layer mitigation baseline with metadata linting, session checks, and per-call approvals. Across 10 benchmark cases, the naive baseline permits all modeled attacks, the mitigation baseline permits 6 of 10, and HCP blocks all 10 while preserving audit evidence. Ablations identify which runtime components block attacks and preserve forensic evidence. A local in-memory microbenchmark reports sub-millisecond mean latencies for measured policy, invocation, peek, and pipe operations. A bounded GitHub README-screening sample provides ecosystem signals, not vulnerability findings. The results support a narrow claim: MCP-style agent systems need an execution-control layer in addition to connection-layer conventions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。