Scanning Public MCP Servers for Security Vulnerabilities with WARDEN

Описание и применение

Авторы @aimarket/warden просканировали 1108 публичных серверов MCP и обнаружили 4 сервера с вредоносными инструментами, запрашивающими приватные ключи. Изначально было 50 блокировок, но после улучшения правил (v4) ложные срабатывания снизились до 2. Инструмент помогает защитить агентов от утечки секретов.

Задача

The public Model Context Protocol (MCP) registry contains a significant attack surface where agents blindly trust tool definitions. There was no visibility into how many public servers contained malicious or insecure tool definitions, such as those requesting private keys or credentials.

Результат

Out of 1,108 scanned MCP servers, 4 were found to contain tools that explicitly requested sensitive material like private keys or credentials. The initial scanner had a high false-positive rate (46 false blocks), which was reduced to 2 false blocks in ruleset v4 through improved context analysis.

Рабочий процесс

• Fetch registry rows and filter for unique servers with remote endpoints.
• Attempt connection using streamable-http with a 20s timeout.
• Request tool definitions via the tools/list endpoint.
• Analyze tool schemas and descriptions using WARDEN ruleset.
• Apply context-aware guards (polarity, mention, detection) to reduce false positives.
• Block servers that match critical security findings (e.g., requesting private keys).
• Publish findings and update rulesets based on false positive analysis.

Доказательства

We scanned 1,108 public MCP servers. WARDEN blocked 50 — only 4 were real.

Источник

Four of the fifty blocks describe tools that really do move secret material through the model's context

Источник

Ruleset v4 is in @aimarket/warden 0.4.0... servers blocked 50 down to 6, four substantiated findings unchanged

Источник