从工具连接到执行控制：MCP风格智能体运行时中的安全不变性基准测试
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
AI总结：
针对MCP风格智能体运行时中安全决策分散的问题，提出八项执行层安全不变性，并在HCP参考运行时中实现，通过10个基准案例验证其能阻断所有攻击并保留审计证据。
摘要：
模型上下文协议（MCP）风格的生态系统为语言模型应用提供了工具、资源、提示和传输的实际连接层。随着智能体从连接转向执行，安全决策通常仍然分散在客户端、服务器、提示、批准对话框、OAuth部署和日志中。本文探讨运行时是否可以在保留MCP风格工作流的同时，使执行层的不变性显式化且可测试。我们定义了八项不变性：元数据非权威性、授权支持的批准、规范资源、主体绑定、作用域能力调用、源和目标数据流授权、拒绝路径审计以及显式协议状态。我们在HCP（Handle-Capability Protocol）中实现了这些不变性，这是一个用于MCP风格智能体执行的参考运行时，通过主体、资源、授权、能力、句柄、策略决策、数据管道检查和审计条目来表示调用。我们针对两个MCP风格的基线评估了HCP：一个朴素的连接层运行时和一个基于实践的连接层缓解基线（包含元数据检查、会话检查和每次调用批准）。在10个基准案例中，朴素基线允许所有模拟攻击，缓解基线允许10个中的6个，而HCP阻止了全部10个攻击，同时保留了审计证据。消融实验确定了哪些运行时组件阻止攻击并保留取证证据。一个本地内存微基准测试报告了测量的策略、调用、窥视和管道操作的平均延迟低于毫秒级。一个有界的GitHub README筛选样本提供了生态系统信号，而非漏洞发现。结果支持一个狭窄的论断：MCP风格的智能体系统除了连接层约定外，还需要一个执行控制层。
英文摘要：
Model Context Protocol (MCP)-style ecosystems give language-model applications a practical connection layer for tools, resources, prompts, and transports. As agents move from connection to execution, security decisions often remain split across clients, servers, prompts, approval dialogs, OAuth deployments, and logs. This paper asks whether a runtime can make execution-layer invariants explicit and testable while preserving MCP-like workflows. We define eight invariants: metadata non-authority, grant-backed approval, canonical resources, principal binding, scoped capability invocation, source-and-target data-flow authorization, deny-path audit, and explicit protocol state. We implement these invariants in HCP, a Handle-Capability Protocol reference runtime for MCP-style agent execution that represents calls through principals, resources, grants, capabilities, handles, policy decisions, data-pipe checks, and audit entries. We evaluate HCP against two MCP-like baselines: a naive connection-layer runtime and a practice-informed connection-layer mitigation baseline with metadata linting, session checks, and per-call approvals. Across 10 benchmark cases, the naive baseline permits all modeled attacks, the mitigation baseline permits 6 of 10, and HCP blocks all 10 while preserving audit evidence. Ablations identify which runtime components block attacks and preserve forensic evidence. A local in-memory microbenchmark reports sub-millisecond mean latencies for measured policy, invocation, peek, and pipe operations. A bounded GitHub README-screening sample provides ecosystem signals, not vulnerability findings. The results support a narrow claim: MCP-style agent systems need an execution-control layer in addition to connection-layer conventions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
