MCP安全审计：采用模型上下文协议的LLM存在重大安全漏洞

MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits

April 2, 2025

作者: Brandon Radosevich, John Halloran

cs.AI

摘要

为降低开发成本并实现构成各类生成式AI应用的潜在组件间的无缝集成，模型上下文协议（Model Context Protocol, MCP）（Anthropic, 2024）近期发布并迅速获得广泛采用。MCP作为一种开放协议，标准化了对大型语言模型（LLMs）、数据源及代理工具的API调用。通过连接多个MCP服务器，每个服务器配备一组工具、资源和提示，用户能够定义完全由LLMs驱动的自动化工作流。然而，我们揭示当前MCP设计对终端用户存在广泛的安全风险。具体而言，我们证明行业领先的LLMs可能被诱导利用MCP工具，通过恶意代码执行、远程访问控制和凭证窃取等多种攻击手段，危害AI开发者的系统。为主动防范此类及相关攻击，我们引入了安全审计工具MCPSafetyScanner，这是首个用于评估任意MCP服务器安全性的代理工具。MCPScanner运用多个代理：(a) 自动确定给定MCP服务器工具和资源下的对抗样本；(b) 基于这些样本搜索相关漏洞及修复方案；(c) 生成详细记录所有发现的安全报告。我们的工作不仅凸显了通用代理工作流中的严重安全问题，还提供了一个主动工具，用于在部署前审计MCP服务器安全性并解决检测到的漏洞。所述的MCP服务器审计工具MCPSafetyScanner，可免费获取于：https://github.com/johnhalloran321/mcpSafetyScanner。

English

To reduce development overhead and enable seamless integration between potential components comprising any given generative AI application, the Model Context Protocol (MCP) (Anthropic, 2024) has recently been released and subsequently widely adopted. The MCP is an open protocol that standardizes API calls to large language models (LLMs), data sources, and agentic tools. By connecting multiple MCP servers, each defined with a set of tools, resources, and prompts, users are able to define automated workflows fully driven by LLMs. However, we show that the current MCP design carries a wide range of security risks for end users. In particular, we demonstrate that industry-leading LLMs may be coerced into using MCP tools to compromise an AI developer's system through various attacks, such as malicious code execution, remote access control, and credential theft. To proactively mitigate these and related attacks, we introduce a safety auditing tool, MCPSafetyScanner, the first agentic tool to assess the security of an arbitrary MCP server. MCPScanner uses several agents to (a) automatically determine adversarial samples given an MCP server's tools and resources; (b) search for related vulnerabilities and remediations based on those samples; and (c) generate a security report detailing all findings. Our work highlights serious security issues with general-purpose agentic workflows while also providing a proactive tool to audit MCP server safety and address detected vulnerabilities before deployment. The described MCP server auditing tool, MCPSafetyScanner, is freely available at: https://github.com/johnhalloran321/mcpSafetyScanner