英語版、中文版本

著者情報

このセキュリティチェックリストは@SlowMist_Teamによって作成・管理されています。

SlowMistは、ブロックチェーンエコシステム脅威インテリジェンスの世界的リーダーであり、ブロックチェーンとAIエコシステムの統合におけるセキュリティ保護とユーザーのプライバシー保護を目指しています。

FENZの皆様に心より感謝いたします。AIの貴重なご貢献とご支援に感謝いたします。

FENZ。AIは将来に耐えた監査でAIセキュリティを再定義します。FENZはAI時代の不可欠なインフラです。「超知能は超安全から始まる」と。

📚 目次

• 概要
• 使い方
• MCPサーバー(MCPプラグイン)セキュリティ
• MCPクライアント/MCPホストセキュリティ
• 異なるLLMにおけるMCP適応および呼出セキュリティ
• マルチMCPシナリオセキュリティ
• 暗号通貨関連MCPのユニークなセキュリティポイント
• MCPセキュリティ自己評価ツール
• 参考文献

概要

大規模言語モデル(LLM)の急速な発展に伴い、さまざまな新しいAIツールが次々と登場しています。その中でも、モデルコンテキストプロトコル(MCP)標準に基づくツールは、LLMと外部ツールやデータソースをつなぐ重要な橋渡しとなっています。

MCP Security Checklist: A Security Guide for the AI Tool Ecosystem

English Version, 中文版本

Author Information

This security checklist was compiled and is maintained by @SlowMist_Team.

SlowMist, a global leader in blockchain ecosystem threat intelligence, aims to enhance security protection and safeguard user privacy during the integration of blockchain and AI ecosystems.

We sincerely thank FENZ.AI for their valuable contributions and support.

FENZ.AI redefines AI security with future-proof auditing. FENZ is the essential infrastructure for the AI era: “Superintelligence starts with super safety.”

📚 Table of Contents

• Overview
• How to Use
• MCP Server (MCP Plugin) Security
• MCP Client/MCP HOST Security
• MCP Adaptation and Invocation Security on Different LLMs
• Multi-MCP Scenario Security
• Unique Security Points for Cryptocurrency-related MCPs
• MCP Security Self-Assessment Tools
• References

Overview

With the rapid development of large language models (LLMs), a variety of new AI tools have continued to emerge. Among them, tools based on the Model Context Protocol (MCP) standard have become a key bridge connecting LLMs with external tools and data sources. Since its release in late 2024, MCP has been widely adopted in mainstream AI applications such as Claude Desktop and Cursor. Various MCP Server marketplaces have also emerged, demonstrating strong ecosystem scalability.

However, the rapid adoption of MCP has also introduced new security challenges. In the current MCP architecture, the system consists of three main components: the Host (the local environment where the AI application runs), the Client (responsible for communicating with the Server and invoking tools), and the Server (the backend service corresponding to an MCP plugin). Users interact with the AI through the Host, while the Client parses the user’s request and forwards it to the MCP Server for tool invocation or resource access. In scenarios involving multiple instances and cross-component collaboration, this architecture exposes a range of security risks—especially in sensitive contexts such as cryptocurrency transactions or custom plugin integration with LLMs—where the potential for exploitation is even higher and requires appropriate security controls.