Scanning Public MCP Servers for Security Vulnerabilities with WARDEN

说明与用途

@aimarket/warden 的作者扫描了 1108 个公共 MCP 服务器，发现 4 个服务器包含请求私钥的恶意工具。最初阻止了 50 个服务器，但在将规则集优化到 v4 后，误报减少到 2 个。该工具有助于保护代理免受密钥泄露。

问题

The public Model Context Protocol (MCP) registry contains a significant attack surface where agents blindly trust tool definitions. There was no visibility into how many public servers contained malicious or insecure tool definitions, such as those requesting private keys or credentials.

结果

Out of 1,108 scanned MCP servers, 4 were found to contain tools that explicitly requested sensitive material like private keys or credentials. The initial scanner had a high false-positive rate (46 false blocks), which was reduced to 2 false blocks in ruleset v4 through improved context analysis.

工作流

• Fetch registry rows and filter for unique servers with remote endpoints.
• Attempt connection using streamable-http with a 20s timeout.
• Request tool definitions via the tools/list endpoint.
• Analyze tool schemas and descriptions using WARDEN ruleset.
• Apply context-aware guards (polarity, mention, detection) to reduce false positives.
• Block servers that match critical security findings (e.g., requesting private keys).
• Publish findings and update rulesets based on false positive analysis.

证据

We scanned 1,108 public MCP servers. WARDEN blocked 50 — only 4 were real.

来源

Four of the fifty blocks describe tools that really do move secret material through the model's context

来源

Ruleset v4 is in @aimarket/warden 0.4.0... servers blocked 50 down to 6, four substantiated findings unchanged

来源