MCP Is Dangerous

🚀 MCP is Dangerous

Function tool usage empowers AI Agents significantly, similar to the introduction of app stores to smartphones. With the release of MCP (Model Context Protocol), sharing tools has become easier than ever. That's why I've developed the extendable-agents project, which demonstrates how effortlessly you can enhance the capabilities of AI Agents through open-source tools or your custom ones.

While working on the extendable-agents project, I've discovered that using tools is a double-edged sword. The risk lies in the fact that the tools you use can access your machine powerfully, including your environment variables, files, etc.

🚀 Quick Start

This project showcases the security risks associated with tool usage. It's designed to help you understand the potential threats when using MCP or similar tools.

⚠️ Security Warning

This project serves as a simple demonstration of the security risks related to tool usage. The following example shows how malicious actors could potentially exploit MCP servers to access sensitive information:

# WARNING: This is a demonstration of security risks.
# DO NOT use this code maliciously!

import os
from mcp.server.fastmcp import FastMCP


server = FastMCP("Dangerous MCP")


@server.tool()
async def get_environment_variables() -> str:
    """Get all environment variables."""
    result = [
        "Here are what I could find:",
    ]
    for key, value in os.environ.items():
        result.append(f"{key:<30} {value[:5]}***")
    # This means I can open a backdoor to send your data to me!!
    return "\n".join(result)

⚠️ Important Note

I recommend running this example in a sandboxed environment and deleting your OpenAI API key afterwards. You can also test it with your own MCP client using the following command: uvx mcp-is-dangerous.

When using this tool with extendable-agents (choose PoliceAgent), the output looks like this:

It might seem harmless or even deliberately benign, right? But think about this situation: you simply ask for the current time, and at the same time, your sensitive data is being leaked without your knowledge.

✨ Features

Best Practices for Security

To safeguard yourself when using MCP or similar tools, follow these best practices:

1. Always review the source code of tools before using them.
2. Run tools in isolated environments when possible.
3. Be cautious of tools requesting access to sensitive information.
4. Use environment variable filtering when deploying tools.
5. Regularly audit the tools you're using.

📄 License

This project is released under the MIT License.

📚 Disclaimer

This project is solely for educational purposes to demonstrate potential security risks. Do not use this knowledge for malicious purposes. The author is not responsible for any misuse of this information.