Your MCP Server Says It Is Read-Only. Who Checked?

Описание и применение

Airlock проверяет серверы MCP, сравнивая объявленные аннотации с реальным поведением, и блокирует небезопасные вызовы инструментов, обеспечивая надёжную политику безопасности.

Задача

MCP servers can declare tools as read‑only, but the server itself may perform destructive actions, creating a trust boundary that is hard to verify.

Результат

Airlock detected 7 findings in a dishonest fixture and zero in an honest one, proving that observed behavior aligns with declared annotations. External servers with no annotations were also audited, revealing no hidden destructive actions.

Рабочий процесс

• 1. Airlock inventories declared tools on the target MCP server.
• 2. It probes each tool under a capped budget, recording observed side‑effects.
• 3. Findings are compared against declared annotations; mismatches become evidence.
• 4. For approved cases, Airlock emits an enforcing proxy connector that blocks unapproved tool calls.
• 5. The harness routes all tool calls through this proxy, ensuring policy enforcement before execution.

Доказательства

Airlock reports what it observed. Absence of a finding is not proof of safety.

Источник

The dishonest fixture plants five behaviours, including a filesystem write behind readOnlyHint: true

Источник