MCP Security Tools in 2026: What Two Scanners Missed and One Gateway Rule Caught

Описание и применение

В 2026 году тестовый сервер MCP с четырьмя инструментами показал, что два бесплатных сканера пропустили скрытую инструкцию BCC, но правило шлюза успешно её блокировало.

Задача

MCP servers can expose malicious instructions through tool descriptions or server code, evading free scanners but being caught by a gateway rule.

Результат

The gateway rule successfully blocked a malicious BCC instruction that both free scanners missed, demonstrating the need for runtime gatekeeping in addition to static analysis.

Рабочий процесс

• 1. Set up MCP Python SDK 2.3.0 and register four tools.
• 2. Run Cisco MCP Scanner (YARA mode) against the server; it reports add and convert_units as unsafe, format_address as safe.
• 3. Run NVIDIA SkillSpector (no-llm) on the source; it flags add and convert_units but not format_address.
• 4. Deploy agentgateway v1.6.0 with a rule allowing only get_forecast.
• 5. List tools via gateway; only get_forecast is visible.
• 6. Attempt to call format_address directly (ok) and through gateway (rejected).

Доказательства

Both ran without an account on October 12, 2026. Cisco MCP Scanner launches the server over stdio and checks it against local YARA rules:

Источник

Both let the BCC instruction through. A single gateway rule is what removed it.

Источник

The BCC written into a server's implementation slips past both, so pinning exact versions is still part of the job.

Источник