Agentic AI security / Detection research
MCP Security Review Framework
MCP-DETECT captures Model Context Protocol tool traffic, applies a bounded set of structural and stateful detections, inventories observed trust boundaries, and prepares evidence for a human security reviewer.
Supervised tooling for a human-led review. Not autonomous enforcement, not complete MCP protection, not a production drop-in.
Claim
Makes selected MCP behaviors observable and produces reproducible evidence for five implemented abuse techniques.
Evidence
Ten rules plus two parent anchors, a 4,727-record benign corpus, five compiler gates, and an 18-class evasion corpus.
Boundary
All data is self-authored, 5 of roughly 85 SAF-MCP techniques are implemented, and there is no semantic detection backend.
The problem
Ordinary reviews miss the tool-call layer.
MCP connects agents to filesystems, ticketing, memory stores, and internal services. A configuration review can list declared permissions, but it cannot show which tools were actually advertised, what arguments moved through them, whether metadata changed mid-session, or whether an undeclared server appeared in live traffic.
So the project asks a narrower question: what evidence can be extracted from MCP traffic, which abuse techniques are detectable from that evidence, and which classes need controls outside telemetry?
Architecture
Capture once, analyze through bounded paths.
- Observe Transparent proxy Forwards MCP JSON-RPC bytes untouched and emits one JSONL event per message.
- Structure Telemetry schema Normalizes sessions, server commands, tools, arguments, and direction.
- Detect Rules and baseline Wazuh handles structural patterns. Python tracks stateful metadata drift.
- Measure Framework gates Runs fixtures, joins alerts to sessions, measures coverage, and records gaps.
- Review Human assessment A reviewer interprets the evidence, validates context, and recommends controls.
Implemented coverage
Five techniques, each with a named evasion.
Tool poisoning
Flags hidden instructions embedded in advertised tool descriptions. It does not catch every semantic manipulation, and meaning-preserving rewrites can evade it.
Credential exfiltration
Correlates a sensitive-file read with secret-shaped content leaving in a later tool argument. Encoded or transformed secrets can evade plaintext matching.
Sensitive absolute paths
Matches a bounded list of high-risk absolute paths used with content-exposing file tools. Renamed tools, new paths, or indirection can evade.
Path traversal
Detects relative escape patterns in file-tool arguments. It complements, and does not replace, server-side path confinement.
Rug pull
Tracks hash-visible tool and server metadata drift across a stateful baseline. A legitimate upgrade looks identical to a malicious swap at this layer, and behavior-only changes are invisible.
Measurement discipline
Gates tied to real historical bugs.
Each detection declares its backends, rules, session join, fixtures, status, and known gaps in a detection.yaml. The framework compiler checks schema, rule references, fixture references, session-key correctness, and false positives against a frozen benign corpus. Its tests reconstruct earlier failures so a new detection cannot silently reintroduce the same class of mistake.
The corpora and worked examples are self-authored. Results are reproducible, but they are not evidence of performance against independent adversary traffic.
Trust boundaries
An AI Bill of Materials from observed traffic.
The framework inventories observed MCP servers, tool names, version hashes, session counts, filesystem access, and network egress, then compares a declared known-good inventory against observations to surface shadow-server candidates. An unrecognized server is reported as unknown and routed to manual review, not assigned a guessed trust level.
Known limits
The blind spots are part of the result.
- Coverage breadth. Five of roughly 85 SAF-MCP techniques are implemented.
- No semantic backend. Prompt manipulation and meaning-preserving obfuscation are out of scope for the current detections.
- Behavior-only compromise. A tool can return manipulated results without changing any visible metadata.
- Encoded content. Base64 and similar transforms bypass plaintext secret matching.
- Self-authored data. Independent or held-out traffic is the highest-value next validation step.
- Offline analysis. The proxy captures traffic, but the workflow is not positioned as inline production enforcement.
Source
Inspect it yourself.
The proxy, schema, rules, drift detector, compiler gates, coverage reports, and the synthetic assessment report are public.