amineddine/mcphantom
Developer toolsこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Security gateway for MCP: tool-poisoning and rug-pull detection, taint tracking across the LLM boundary, per-tool policy
概要
The verdict in the demo comes from the attacker collector's own request log, not from MCPhantom. The agent is scripted (no model), so the result shows what the defense does, not what a model happened to do. Regenerate it: docs/demo/. Development has been on Windows 11, with CI on Linux, macOS and Windows × Node 22/24. Not published to npm yet (planned for v1). Read Known limitations and bypasses before you rely on it. on a pre-registered third-party set, frozen before the scanner saw it and run once, it caught claimed attacks (Wilson 95% CI 4.6–69.9%) and MSB prompt-injection items (0–29.9%); only 1 of 88 poisoned definitions raised any finding (report). It recognises the phrasings it was built from, not injection prose in general. The earlier 100% / 91.7% / 90-of-90 figures below are on author-written and derived examples, not held-out performance on real attacks.
README
以下は原文 README の抜粋です。原文を見る。
MCPhantom
A security gateway for MCP that blocks the lethal trifecta even when the model paraphrases. It measures its own detection and publishes every bypass it knows about.
The verdict in the demo comes from the attacker collector’s own request log, not from MCPhantom. The agent is scripted (no model), so the result shows what the defense does, not what a model happened to do. Regenerate it: docs/demo/.
Status: v0.1, an early release. Development has been on Windows 11, with CI on Linux, macOS and Windows × Node 22/24. Not published to npm yet (planned for v1). Read Known limitations and bypasses before you rely on it.
The static scanner, measured independently: on a pre-registered third-party set, frozen before the scanner saw it and run once, it caught 1 of 4 claimed attacks (Wilson 95% CI 4.6–69.9%) and 0 of 9 MSB prompt-injection items (0–29.9%); only 1 of 88 poisoned definitions raised any finding (report). It recognises the phrasings it was built from, not injection prose in general. The earlier 100% / 91.7% / 90-of-90 figures below are on author-written and derived examples, not held-out performance on real attacks.
The core protection is the runtime trifecta block, not the scanner. That rule decides by where data came from (context labels), never from the text of an injection, so it does not depend on detecting the injection at all; the scanner is a pre-filter on top.
What it blocks today
| Threat | What MCPhantom does | Reproduce |
|---|---|---|
| Lethal-trifecta exfiltration. Untrusted content steers the agent into sending your secrets out. | Once a session has seen both untrusted and secret data, any egress/exec call (and any write outside its declared workspace) is denied. This check never looks at content, so paraphrasing doesn’t get past it. |
npm run demo, test/demo.e2e.test.ts |
Tool poisoning. Hidden instructions in tool, prompt or server instructions text. |
Scanned before the model sees the list: invisible Unicode, embedded instructions, shadowing, exfiltration hints, including disguised versions (look-alike characters, base64/hex/URL encoding, letter-spacing, …). A flagged tool is removed from tools/list. On a fresh third-party held-out set it caught only 1 of 13 injected descriptions (see Measured results): it recognises the attack phrasings it was built from, not injection prose in general. An injection it misses is still subject to the trifecta rule above. |
npm run bench:scanner, npm run bench:evasion, npm run bench:heldout, test/scanner.gateway.test.ts |
インストール
This server does not publish a one-line install command.
Open the repository installation guide MCP 初心者？mcpskill.org のガイドから始めましょう →