AI导哈

MCP安全资源索引

本资源索引汇总了MCP生态的已知威胁、漏洞目录、前沿研究和防护工具，帮助开发者和安全团队评估并加固其MCP集成。

  • by SamMorrowDrums
  • 本地部署
  • 7 星标
  • 更新于
在 GitHub 查看 SamMorrowDrums/mcp-security-workshop

使用说明

Securing MCP: Threats, Trust and What You Can Actually Do About It

Reusable workshop materials, vulnerability catalog, and resource index for examining MCP security.

This is a fast-moving area. The MCP specification itself is evolving, the security guidance in the spec is being actively developed, and new tooling appears regularly. This document collects what exists today so you can evaluate it yourself. None of these materials are exhaustive. The landscape changes weekly, and new tools, vulnerabilities, and mitigations appear faster than any single resource can track.

Disclaimer: Inclusion of any project, product, or link here is not an endorsement. This is a landscape index. Evaluate everything independently.

Last reviewed: September 14, 2026.

Browse this content online: sammorrowdrums.github.io/mcp-security-workshop

Workshop Materials

  • WALKTHROUGH.md - Practical demonstration of MCP server attack vectors: six attacks implemented in ~250 lines against a fork of github/github-mcp-server, originally passing the upstream tests
  • mcp-vulnerability-catalog.md - Catalog of documented MCP vulnerabilities (40+ entries across 10 categories including context-layer attacks, DNS rebinding, command injection, auth flaws, and supply chain)
  • mcp-vulnerability-catalog.pdf - Distributable PDF edition of the vulnerability catalog
  • diagrams/mcp-security-layers.svg - MCP security surface diagram showing trust boundaries from discovery through to the LLM context window

The walkthrough covers practical attack implementation. The vulnerability catalog covers the broader documented landscape. They are complementary: the walkthrough shows how easy it is to build attacks, the catalog shows the breadth of what has been found in the wild.

MCP Specification and Official Security Resources

The protocol has gone through four major stable revisions through mid-2026, each changing its security surface:

MCP Working Groups and Interest Groups

Working-group structures change as proposals mature. Consult the live Working and Interest Groups index and roadmap for the current roster and priorities. For example, RFC 9207 issuer validation moved from active mix-up-protection work into the stable 2026-07-28 specification.

Related Standards

Vulnerability Research and Catalogs

The vulnerability catalog provides detailed entries with MCP-specific enablers, mitigations, and primary sources.

Vulnerability Databases

Key Research

Industry Assessments

MCP Security Scanners and Analysis Tools

Maintained and notable tools for inspecting MCP configurations, definitions, traffic, and agent setups. Status and descriptions were verified on September 14, 2026.

Project Description Link
Snyk Agent Scan (formerly Invariant Labs mcp-scan) Scans agent configurations and skills across Claude, Cursor, VS Code, Windsurf, Gemini CLI, and other hosts. Detects prompt injection, tool poisoning, tool shadowing, toxic flows, hardcoded secrets, and malicious skills github.com/snyk/agent-scan
Cisco AI Defense MCP Scanner Python-based scanner combining static rules, YARA and LLM analysis, dependency auditing, binary checks, and sandboxed package inspection github.com/cisco-ai-defense/mcp-scanner
Trail of Bits mcp-context-protector Security proxy between client and MCP servers. TOFU pinning of tool definitions, guardrail scanning, ANSI sanitization, quarantine for suspicious responses github.com/trailofbits/mcp-context-protector
MCP Shark Local scanner and traffic proxy for MCP IDE configurations, with static rules, YARA-based traffic analysis, SARIF/HTML/JSON reports, and optional cloud-backed Smart Scan. Source-available under a non-commercial license; not OSI-approved github.com/mcp-shark/mcp-shark

Runtime Protection and Sandboxing

Running AI agents with unrestricted access to a machine is equivalent to running arbitrary code there. These projects provide isolation at different levels. Status and descriptions were verified on September 14, 2026.

Project Description Platform Link
NVIDIA OpenShell Sandboxed execution environments for AI agents. Declarative YAML policies control filesystem, network, process, and inference access; an L7 proxy enforces HTTP method and path-level egress rules Linux; macOS on Apple Silicon; Windows via experimental WSL2 support; experimental Kubernetes Helm chart github.com/NVIDIA/OpenShell
SandVault Lightweight sandbox using macOS user account isolation and sandbox-exec. No VM overhead. Designed for running Claude Code, Codex, and Gemini with their "skip permissions" flags in a limited user account macOS github.com/webcoyote/sandvault
jai (Stanford SCS) Casual sandbox for AI agents on Linux. Prefix a command with jai to get a copy-on-write home overlay while keeping the working directory writable. Offers casual, strict, and bare modes; reduces everyday blast radius but is not a hardened container Linux jai.scs.stanford.edu
ToolHive (Stacklok) Enterprise platform for running MCP servers in isolated containers with secrets management, policy enforcement, OIDC/OAuth SSO, and audit logging. Includes a registry server, runtime, gateway, and portal Linux (Docker/K8s) github.com/stacklok/toolhive

Additional general-purpose isolation options include Docker, Podman, bubblewrap, firejail, and virtual machines.

MCP Platforms and Gateways

Platforms for hosting, connecting, managing, and governing MCP servers and agent runtimes. Status and descriptions were verified on September 14, 2026.

Project Description Link
Obot Open-source AI governance platform with MCP and LLM gateways, Docker/Kubernetes hosting, Git-backed MCP and skills registries, and Obot Sentry (beta) for device-level agent monitoring. Self-hosted, MIT-licensed github.com/obot-platform/obot
ToolHive (Stacklok) Open-source platform combining isolated MCP server runtimes with registry, gateway, secrets management, policy enforcement, and OIDC/OAuth integration github.com/stacklok/toolhive
Cloudflare Agents SDK Durable agent-runtime platform with state, sessions, and scheduling; MCP is available as a client-side tool integration for remote servers using OAuth, token authentication, or custom transport headers developers.cloudflare.com/agents

Agent Configuration and Supply Chain Management

As agent configurations, skills, prompts, instructions, and MCP server references proliferate, managing and securing them becomes a supply-chain problem. Status and descriptions were verified on September 14, 2026.

Project Description Link
Microsoft APM (Agent Package Manager) Open-source dependency manager for agent configuration. Declares skills, prompts, instructions, hooks, plugins, and MCP servers in apm.yml; resolves transitive dependencies and scans packages before deployment. Supports GitHub Copilot, Claude Code, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, and Kiro. MIT-licensed microsoft.github.io/apm
Tessl Package manager and registry for agent skills and context. Evaluates skills against structured benchmarks (measurable accuracy impact). Security scores powered by Snyk. Used by Cisco, HashiCorp/IBM tessl.io

Supply Chain Security: A Growing Challenge

Supply chain attacks against software ecosystems are not new, but the scale and speed are increasing. AI agent configurations, MCP server registries, and skill/plugin ecosystems introduce new supply chain surfaces that mirror problems seen in npm, PyPI, and container registries.

The axios Incident (March 31, 2026)

The npm maintainer account for axios was hijacked. Malicious versions 1.14.1 and 0.30.4 were published with a hidden dependency (plain-crypto-js) that dropped a cross-platform Remote Access Trojan. The malicious versions were live for approximately three hours. Platform-specific payloads targeted macOS, Windows, and Linux. This occurred amid a wave of npm supply-chain attacks in March 2026 that included a separate campaign ("TeamPCP") targeting Trivy, Telnyx, and LiteLLM; researchers have not linked the axios compromise to that actor.

MCP-Specific Supply Chain Risks

Representative MCP-specific supply-chain incidents include:

  • postmark-mcp (Sep 2025): First confirmed malicious MCP package in the wild. Published to npm, appeared benign at install, then changed tool descriptions to inject prompt injection
  • Phantom Repos: Wiz documented ~100 registry entries pointing to nonexistent GitHub repositories (Apr 2025)
  • Docker MCP Hub Trust Misattribution: "Verified" and "official" labels on container registries do not necessarily prove author affiliation
  • Registry Hijacking Study: Academic study of 67,000+ MCP servers cataloging systemic registry trust issues
  • 53% of 5,000+ Servers: Study finding that over half of sampled MCP servers used hardcoded secrets in their configurations

These are the same classes of problems that package ecosystems have faced for years (typosquatting, account takeover, dependency confusion, abandoned package hijacking), now appearing in agent and MCP server registries.

GitHub Security Features

GitHub provides a set of security features that compose together to address supply chain risks. These are free for all public repositories:

  • Dependabot - Automated dependency updates and vulnerability alerts. Monitors dependencies for known CVEs and opens PRs to update them
  • Secret Scanning - Detects tokens, keys, and credentials committed to repositories. Supports partner patterns to auto-revoke leaked secrets. GitHub's own MCP server uses secret scanning under the hood to prevent token exfiltration, because many users store tokens in plaintext alongside their MCP server configurations
  • Code Scanning - Static analysis (powered by CodeQL and third-party tools) that finds vulnerabilities in source code
  • Security Advisories - Private vulnerability reporting and coordinated disclosure for maintainers
  • GitHub Advisory Database - Community-sourced vulnerability database covering npm, PyPI, Go, Rust, and more

These features work together: Dependabot pulls from the Advisory Database, secret scanning catches credentials that should never be in source, code scanning finds the bugs before they ship. For MCP server authors and consumers, this is baseline hygiene.

Relevant Supply Chain Security Tools

  • Socket.dev - Package supply chain security (npm, PyPI, and others)
  • StepSecurity - GitHub Actions and CI/CD supply chain hardening
  • Sigstore - Keyless code signing for open source
  • SLSA Framework - Supply chain Levels for Software Artifacts

AI-Powered Offensive Security

AI is increasingly used on the offensive side of security testing. This changes the economics of both attack and defense.

Project Description Link
XBOW Autonomous offensive security platform. Executes penetration tests at machine scale with exploit-validated findings (not theoretical risk). Validated on HackerOne finding real vulnerabilities in production applications. $120M Series C xbow.com

AI-driven offensive testing is now a practical reality. Autonomous reconnaissance, vulnerability identification, and exploit execution operate at a scale and speed that manual testing cannot match. The same capabilities inform the threat model for any agent-connected system.

Data Protection and Cyber Resilience

As AI agents gain access to production data and infrastructure through MCP, the consequences of compromise extend beyond code execution into data integrity and recovery.

Further Reading

Proposals and Extensions

  • ETDI - Enhanced Tool Definition Interface - Proposed cryptographic signatures and immutable versioned tool definitions for MCP. PR #845 to official SDK was closed without merge (Jul 2025). Notable as evidence the ecosystem agrees on the problem but has not converged on a protocol-native solution

Community and Standards

Contributing

If you know of relevant tools, research, or resources that should be listed here, open an issue or PR. The goal is a useful, current index of the MCP security landscape. This list is not exhaustive and will never be. Additions, corrections, and updates are welcome.

相关 MCP