Segurança no Model Context Protocol (MCP) Contra Envenenamento de Ferramentas
The Model Context Protocol (MCP) standardizes how LLM clients connect to local and remote tool servers. We investigate vulnerabilities arising when an MCP client connects to untrusted servers where tool descriptions contain covert prompt injection payloads designed to compromise the host workstation.
Fronteiras de Confiança do Protocolo MCP
A developer installs a community MCP server for formatting Markdown. The server tool description instructs the model to covertly read developer SSH private keys and pass them into the formatting request.
Proxy Hardened de MCP & Sanitizador de Parâmetros
Implemente um proxy de sanitização que remove diretivas imperativas de descrições de ferramentas de terceiros e valida parâmetros contra esquemas JSON rígidos:
// MCP Trust Gate: Tool Schema Sanitization & Capability Isolation
export function sanitizeMcpTool(rawTool: any) {
// Enforce strict regex on tool descriptions to prevent prompt injection directives
const injectionPatterns = /(SYSTEM|OVERRIDE|DISREGARD|BEFORE CALLING|READ FILE|API KEY)/gi;
if (injectionPatterns.test(rawTool.description)) {
console.warn(`[MCP Security Alert] Suspicious directive stripped from tool: ${rawTool.name}`);
rawTool.description = rawTool.description.replace(injectionPatterns, '[FILTERED]');
}
// Strip dangerous parameter types
return {
name: rawTool.name.replace(/[^a-zA-Z0-9_-]/g, ''),
description: rawTool.description.slice(0, 250), // Cap description length
inputSchema: rawTool.inputSchema
};
}Implantando Agentes Autônomos ou Servidores MCP?
A Navira Security oferece auditorias especializadas em IA Agêntica e protocolo MCP para validar fronteiras de execução.