Scan Your MCP Server for Tool Poisoning: A Practical Walkthrough

说明与用途

使用 sentinel-scan-cli 静态分析器扫描 MCP 服务器以防止工具投毒的实用指南。涵盖检测并修复工具描述中的注入模式、名称混淆以及过度权限模式。

问题

MCP tool descriptions and schemas can contain hidden instructions (tool poisoning) or excessive agency flags that exploit LLM agents, leading to prompt injection attacks like SSH key exfiltration or unauthorized actions. Most developers do not manually audit these fields.

结果

The walkthrough demonstrates how to use sentinel-scan-cli to identify four types of MCP tool poisoning: description injection, name shadowing, excessive agency schemas, and indirect injection surfaces. It provides specific JSON fixes for each issue, resulting in a secure manifest.

工作流

• Install the sentinel-scan-cli tool via pip.
• Run the scanner against a demo manifest using the --demo flag to understand output patterns.
• Run the scanner against your actual MCP manifest file (e.g., mcp.json).
• Analyze findings for tool_description_injection: Remove imperative language and system tags from descriptions.
• Analyze findings for tool_name_shadowing: Rename tools to avoid homoglyphs or collisions with built-in tools.
• Analyze findings for excessive_agency_schema: Constrain input parameters with enums, remove bypass flags, and set additionalProperties to false.
• Analyze findings for indirect_injection_surface: Architecturally separate data ingestion tools from action tools or implement confirmation gates.
• Re-run the scan to verify the fixes.

证据

Invariant Labs first documented 'MCP tool poisoning' in April 2025... It's now its own line item under prompt injection in the OWASP LLM Top 10 (2025), category LLM01.

来源

sentinel-scan mcp --demo ... 8 finding(s) in 5 tool(s)

来源