agent-scan

At Snyk, we've been working on this for a while. Here's our flagship open source project consolidating a lot of the MCP risk factors we've discovered over the last year or so into actionable info: https://github.com/invariantlabs-ai/mcp-scan

This is way more common with popular MCP server/agent toolsets than you would think. For those interested in some threat modeling exercise, we recently added a feature to mcp-scan that can analyze toolsets for potential lethal trifecta scenarios. See [1] and [2]. [1] toxic flow analysis, https://invariantlabs.ai/blog/toxic-flow-analysis [2] mcp-scan, https://github.com/invariantlabs-ai/mcp-scan

One of the authors here. Thanks for posting. If you are interested in learning more about MCP and agent security, check out some of the following resources, that we have created since we started working on this: * The full execution trace of the Claude session in this attack scenario: https://explorer.invariantlabs.ai/trace/5f3f3f3c-edd3-4ba7-a... * MCP-Scan, A security scanner for MCP connections: https://github.com/invariantlabs-ai/mcp-scan * MCP Tool Poisoning Attacks, https://invariantlabs.ai/blog/mcp-security-notification-tool... * WhatsApp MCP Exploited, https://invariantlabs.ai/blog/whatsapp-mcp-exploited * Guardrails, a contextual security layer for agents, https://invariantlabs.ai/blog/guardrails * AgentDojo, Jointly evaluate security and utility of AI agents https://invariantlabs.ai/blog/agentdojo

Original author of some of the initial security notes at Invariant Labs here. Some resources, if you want to learn about MCP security: * Initial Security Note describing Tool Poisoning, Rug Pulls, Tool Shadowing for the first time with diagrams and detailed experiments: https://invariantlabs.ai/blog/mcp-security-notification-tool..., * Attack on WhatsApp MCP (both tool poisoning but also take-over via an infected message to your account): https://invariantlabs.ai/blog/whatsapp-mcp-exploited * BrowserMCP attack, where it suffices for the agent to visit a compromised website (https://access.invariantlabs.ai): https://x.com/lbeurerkellner/status/1912145060763742579 We also recently released a security scanning tool to detect and prevent such attacks, including upcoming support for full proxying and local security scanning of tool calling pay

Cool work! Thanks for citing our (InvariantLabs) blog posts! I really like the identify-as feature! We recently launched a similar tool ourselfs, called mcp-scan: https://github.com/invariantlabs-ai/mcp-scan