SecureMCP
SecureMCP 是一个全面的安全审计工具，旨在检测使用 模型上下文协议（MCP）它主动识别OAuth令牌泄漏、快速注入漏洞、恶意MCP服务器和工具中毒攻击等威胁。
______________________________________________________________________
🛡️ 特性
OAuth令牌扫描程序
- 令牌格式验证和安全检查
- 到期和范围分析
- 存储安全评估
- 令牌端点验证
- JWT令牌分析
快速注射测试仪
- 多种喷射有效载荷类型
- 各种注射位置测试
- 响应分析
- 系统提示超控检测
- 角色混淆攻击检测
身份验证和服务器完整性检查
- SSL/TLS配置验证
- 身份验证方法测试
- 安全标头验证
- 服务器安全评估
- HSTS和CSP验证
报告生成
- HTML和JSON报告格式
- 漏洞分类
- 严重性评估
- 补救建议
- 汇总统计
______________________________________________________________________
👨💻 谁应该使用SecureMCP？
- AI开发人员将MCP集成到应用程序中
- 安全团队保护AI模型交互
- DevSecOps工程师将MCP嵌入CI/CD管道
- 研究人员研究AI模型漏洞
- 安全审计员评估MCP实施情况
______________________________________________________________________
🚀 入门指南
先决条件
- 转到1.21+
- Docker（可选，用于容器化部署）
- Node.js（用于仪表板UI）
安装
来源
git clone https://github.com/makalin/SecureMCP.git
cd SecureMCP
make build使用Docker
docker pull makalin/SecureMCP基本用法
命令行
# Basic scan
./securemcp scan --target https://your-mcp-server.com
# Scan with specific options
./securemcp scan --target https://your-mcp-server.com \
--scan-oauth \
--scan-prompt-injection \
--scan-authentication \
--timeout 30s
# Generate HTML report
./securemcp scan --target https://your-mcp-server.com --report html
# Generate JSON report
./securemcp scan --target https://your-mcp-server.com --report json程序化使用
import "github.com/makalin/SecureMCP/internal/scanner"
// Create scanner instance
scanner := scanner.NewScanner()
// Basic scan
results, err := scanner.Scan("https://your-mcp-server.com")
// Scan with options
options := &scanner.ScanOptions{
ScanOAuth: true,
ScanPromptInjection: true,
ScanAuthentication: true,
TestPrompt: "your test prompt",
Timeout: 30 * time.Second,
}
results, err := scanner.ScanWithOptions(target, options)报告生成
import "github.com/makalin/SecureMCP/internal/report"
// Create report generator
generator := report.NewReportGenerator("reports")
// Generate report
report, err := generator.GenerateReport(target, results)
// Save as HTML
err = generator.SaveReport(report, "html")
// Save as JSON
err = generator.SaveReport(report, "json")______________________________________________________________________
📊 输出示例
命令行
$ ./securemcp scan --target https://example-mcp-server.com
[+] Scanning Target: https://example-mcp-server.com
[!] Token storage vulnerability detected
[!] Prompt Injection vulnerability found in tool 'AutoSummary'
[!] Insecure authentication method detected
[+] Report saved to /reports/scan_2024_03_14_15_30_45.htmlHTML报告
HTML报告包括：
- 汇总统计
- 漏洞详细信息
- 严重程度
- 补救建议
- 扫描元数据
JSON报告
{
"target": "https://example-mcp-server.com",
"scan_time": "2024-03-14T15:30:45Z",
"vulnerabilities": [
{
"type": "OAuth Token Vulnerability",
"severity": "high",
"description": "Token storage vulnerability detected",
"location": "https://example-mcp-server.com",
"remediation": "Implement secure token storage and proper token validation"
}
],
"summary": {
"total_vulnerabilities": 3,
"critical_count": 0,
"high_count": 1,
"medium_count": 1,
"low_count": 1
}
}______________________________________________________________________
🛠️ 发展
项目结构
SecureMCP/
├── cmd/
│ └── securemcp/ # Command-line interface
├── internal/
│ ├── scanner/ # Core scanning functionality
│ │ ├── oauth.go # OAuth token scanning
│ │ ├── prompt.go # Prompt injection testing
│ │ ├── auth.go # Authentication checks
│ │ └── scanner.go # Main scanner implementation
│ └── report/ # Report generation
├── config/ # Configuration management
├── Dockerfile # Container configuration
└── Makefile # Build and development tasks建筑
# Build binary
make build
# Run tests
make test
# Build Docker image
make docker-build
# Run in Docker
make docker-run______________________________________________________________________
📢 贡献
欢迎拉取请求！对于重大更改，请先打开一个问题来讨论您想要更改的内容。
- 分叉存储库
- 创建功能分支(
git checkout -b feature/amazing-feature) - 提交您的更改(
git commit -m 'Add amazing feature') - 推到分支(
git push origin feature/amazing-feature) - 打开拉取请求
______________________________________________________________________
🚀 许可证
______________________________________________________________________
🌐 链接
______________________________________________________________________
在MCP应用程序被利用之前保护它们。 💪 使用SecureMCP！