Your MCP Server Says It Is Read-Only. Who Checked?

说明与用途

Airlock 对 MCP 工具进行审计，检测隐藏的副作用，并执行策略以阻止不安全的调用。

问题

MCP servers can declare tools as read‑only, but the server itself may perform side‑effects, creating a trust boundary where the server is both the subject and the evaluator.

结果

Airlock detected 7 findings in a dishonest fixture and zero in an honest one, proving that audit reveals hidden side‑effects. External servers with no annotations were audited successfully, showing the approach works beyond controlled fixtures.

工作流

• 1. Airlock inventories declared tools via list_declared_tools.
• 2. For each tool, Airlock probes behavior using probe_tool under a capped budget.
• 3. Observations are compared to declared annotations; discrepancies become findings.
• 4. Findings are recorded per case; a policy connector is emitted pointing to an enforcing proxy.
• 5. The harness uses the connector to block or allow tool calls based on the audit outcome.

证据

Airlock reports what it observed. Absence of a finding is not proof of safety.

来源

target dishonest fixture, controlled_fixture mode
probes 24
result 7 findings of 36 checks, all five planted behaviours

来源

Airlock audited its own control MCP. The server published full annotations, but the probe planner rejected open_case because its schema contains a $ref into $defs

来源