Your MCP Server Says It Is Read-Only. Who Checked?

说明与用途

Airlock 对 MCP 服务器进行审计，比较声明的只读注解与实际行为，并执行策略以阻止不安全的工具调用，确保可靠的安全性。

问题

MCP servers can declare tools as read‑only, but the server itself may perform destructive actions, creating a trust boundary that is hard to verify.

结果

Airlock detected 7 findings in a dishonest fixture and zero in an honest one, proving that observed behavior aligns with declared annotations. External servers with no annotations were also audited, revealing no hidden destructive actions.

工作流

• 1. Airlock inventories declared tools on the target MCP server.
• 2. It probes each tool under a capped budget, recording observed side‑effects.
• 3. Findings are compared against declared annotations; mismatches become evidence.
• 4. For approved cases, Airlock emits an enforcing proxy connector that blocks unapproved tool calls.
• 5. The harness routes all tool calls through this proxy, ensuring policy enforcement before execution.

证据

Airlock reports what it observed. Absence of a finding is not proof of safety.

来源

The dishonest fixture plants five behaviours, including a filesystem write behind readOnlyHint: true

来源