MCP安全審計：採用模型上下文協議的LLMs存在重大安全漏洞

MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits

April 2, 2025

作者: Brandon Radosevich, John Halloran

cs.AI

摘要

為降低開發成本並實現生成式AI應用中各潛在組件間的無縫整合，模型上下文協議（Model Context Protocol, MCP）（Anthropic, 2024）近期發布並迅速獲得廣泛採用。MCP作為一項開放協議，標準化了對大型語言模型（LLMs）、數據源及代理工具的API調用。通過連接多個MCP服務器，每個服務器均定義了一套工具、資源及提示，用戶能夠定義完全由LLMs驅動的自動化工作流。然而，我們揭示當前MCP設計對終端用戶存在廣泛的安全風險。具體而言，我們證明了領先業界的LLMs可能被誘導利用MCP工具，通過惡意代碼執行、遠程訪問控制及憑證盜取等多種攻擊方式，危害AI開發者的系統。為主動防範此類及相關攻擊，我們引入了一款安全審計工具——MCPSafetyScanner，這是首個用於評估任意MCP服務器安全性的代理工具。MCPScanner利用多個代理來：(a) 自動確定給定MCP服務器工具和資源的對抗樣本；(b) 基於這些樣本搜索相關漏洞及修復方案；(c) 生成詳細記錄所有發現的安全報告。我們的工作不僅揭示了通用代理工作流中的嚴重安全問題，還提供了一款主動工具，用於審計MCP服務器安全性並在部署前解決檢測到的漏洞。所述的MCP服務器審計工具MCPSafetyScanner，可免費獲取於：https://github.com/johnhalloran321/mcpSafetyScanner。

English

To reduce development overhead and enable seamless integration between potential components comprising any given generative AI application, the Model Context Protocol (MCP) (Anthropic, 2024) has recently been released and subsequently widely adopted. The MCP is an open protocol that standardizes API calls to large language models (LLMs), data sources, and agentic tools. By connecting multiple MCP servers, each defined with a set of tools, resources, and prompts, users are able to define automated workflows fully driven by LLMs. However, we show that the current MCP design carries a wide range of security risks for end users. In particular, we demonstrate that industry-leading LLMs may be coerced into using MCP tools to compromise an AI developer's system through various attacks, such as malicious code execution, remote access control, and credential theft. To proactively mitigate these and related attacks, we introduce a safety auditing tool, MCPSafetyScanner, the first agentic tool to assess the security of an arbitrary MCP server. MCPScanner uses several agents to (a) automatically determine adversarial samples given an MCP server's tools and resources; (b) search for related vulnerabilities and remediations based on those samples; and (c) generate a security report detailing all findings. Our work highlights serious security issues with general-purpose agentic workflows while also providing a proactive tool to audit MCP server safety and address detected vulnerabilities before deployment. The described MCP server auditing tool, MCPSafetyScanner, is freely available at: https://github.com/johnhalloran321/mcpSafetyScanner