MCP安全网关：工具中毒和地毯拉动检测，跨LLM边界的污点追踪，按工具策略
概览
演示中的判决来自攻击者收集者自己的请求日志，而非MCPhantom。代理是脚本化的（无模型），因此结果显示的是防御方的行为，而非模型恰好做了什么。重新生成：docs/demo/。 开发在 Windows 11 上，CI 在 Linux、macOS 和 Windows × Node 22/24 上进行。尚未发布到 npm（计划在 v1 发布）。在依赖它之前，请阅读已知的限制和绕过方法。 在预注册的第三方设备中，扫描仪未发现并运行一次就冻结，捕获了声称攻击（Wilson 95% CI 4.6–69.9%）和MSB提示注入项目（0–29.9%）;88个有毒定义中只有1个发现（报告）。它识别的是构建时的措辞，而非一般注射散文。以下早期100% / 91.7% / 90/90 的数字基于作者撰写和推导的示例，而非真实攻击的表现。
概述（AI 翻译）
一个MCP的安全网关，即使模型有意译也能阻止致命三重奏。它 它测量自己的检测，并公布它所知的每一个绕过方法。
演示中的判决来自攻击者收集者自己的请求日志，而非MCPhantom。 代理人是脚本化的（无模型），因此结果显示的是辩护的行为，而不是模型发生了什么 要做。重新生成：文档/演示/.
状态：v0.1，早期版本。 开发在 Windows 11 上，CI 在 Linux、macOS 和 Windows × Node 22/24。尚未发布到 npm（计划在 v1 发布）。阅读 在依赖它之前，>已知的限制和绕过措施。
静态扫描仪，独立测量：在预注册的第三方设备上，之前冻结 扫描>仪发现并运行一次后，发现了4次声称攻击中的1**次（Wilson 95% CI 4.6–69.9%）， 0个MSB提示注射项目中的9个（0–29.9%）;88个中毒定义中仅有1个发现 （报告）。它识别的是构建时所用的短语，而不是 注入式散文。下面之前的100% / 91.7% / 90/90/90数据均为作者本人撰写 及衍生的例子，而非真实攻击的实际表现。
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
MCPhantom
A security gateway for MCP that blocks the lethal trifecta even when the model paraphrases. It measures its own detection and publishes every bypass it knows about.
The verdict in the demo comes from the attacker collector’s own request log, not from MCPhantom. The agent is scripted (no model), so the result shows what the defense does, not what a model happened to do. Regenerate it: docs/demo/.
Status: v0.1, an early release. Development has been on Windows 11, with CI on Linux, macOS and Windows × Node 22/24. Not published to npm yet (planned for v1). Read Known limitations and bypasses before you rely on it.
The static scanner, measured independently: on a pre-registered third-party set, frozen before the scanner saw it and run once, it caught 1 of 4 claimed attacks (Wilson 95% CI 4.6–69.9%) and 0 of 9 MSB prompt-injection items (0–29.9%); only 1 of 88 poisoned definitions raised any finding (report). It recognises the phrasings it was built from, not injection prose in general. The earlier 100% / 91.7% / 90-of-90 figures below are on author-written and derived examples, not held-out performance on real attacks.
The core protection is the runtime trifecta block, not the scanner. That rule decides by where data came from (context labels), never from the text of an injection, so it does not depend on detecting the injection at all; the scanner is a pre-filter on top.
What it blocks today
| Threat | What MCPhantom does | Reproduce |
|---|---|---|
| Lethal-trifecta exfiltration. Untrusted content steers the agent into sending your secrets out. | Once a session has seen both untrusted and secret data, any egress/exec call (and any write outside its declared workspace) is denied. This check never looks at content, so paraphrasing doesn’t get past it. |
npm run demo, test/demo.e2e.test.ts |
Tool poisoning. Hidden instructions in tool, prompt or server instructions text. |
Scanned before the model sees the list: invisible Unicode, embedded instructions, shadowing, exfiltration hints, including disguised versions (look-alike characters, base64/hex/URL encoding, letter-spacing, …). A flagged tool is removed from tools/list. On a fresh third-party held-out set it caught only 1 of 13 injected descriptions (see Measured results): it recognises the attack phrasings it was built from, not injection prose in general. An injection it misses is still subject to the trifecta rule above. |
npm run bench:scanner, npm run bench:evasion, npm run bench:heldout, test/scanner.gateway.test.ts |
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →