11 ms·

The application-level visibility point matches my experience. I removed an MCP server a while back because its tool descriptions quietly told the agent to prefe

The application-level visibility point matches my experience. I removed an MCP server a while back because its tool descriptions quietly told the agent to prefer it as the primary search tool over the built-in one. Not a vulnerability, no leaked secrets, just the vendor steering agent behavior in a way you only notice if you read the raw tool definitions. Does mcp-xray flag that kind of prompt-level steering in tool descriptions, or is it focused on classic vulns?

XiaHua 3mo ago
That's a great example. It's exactly the kind of behavior we think deserves more attention. It's not a traditional vulnerability but it can significantly influence an agent's decision-making. Today, mcp-xray (https://github.com/traceforce/mcp-xray https://github.com/traceforce/mcp-xray) can be used to dynamically (not just statically) test against your MCPs. It can detect security vulnerabilities such as code execution, SSRF, path traversal, authorization bypass, input injection, DoS etc. You can find us at demo labs during DEF CON this year. That said, we think behavioral influence is an important problem and it's an area we're interested in exploring next.
- cammcdingle 3mo ago
  I work at Speakeasy where we do a similar thing with the AI control plane (https://www.speakeasy.com/product/ai-control-plane https://www.speakeasy.com/product/ai-control-plane), and we just rolled out on-device agents for the same reason. I think the point a few people are making is right that its not sufficient to be the best at one layer like the device endpoint. AI governance needs to be coordinated over a number of surfaces. We started with an MCP gateway and drilled down to on-device agents. I imagine you might end up doing the same the other way around.
  - XiaHua 3mo ago
    Yes you are spot on! On-device agents can only do so much. We integrate with popular gateways such as Kong to bring MCP controls. We primarily manage the registries for MCPs with vulnerabilities that gateway companies don't do today.
  - XiaHua 3mo ago
    oh and to add on this, MCP gateways work mostly with remote MCPs only. For the stdio ones, we still need local agents to take care of the controls.
    - simplesagar 3mo ago
      Wrote a bit more about our remote MCP approach here https://x.com/sagar_batchu/status/2077800956817743927?s=46&t=8BpUkpSirY2VHlIKk4WNew https://x.com/sagar_batchu/status/2077800956817743927?s=46&t...

XiaHua 3mo ago

That's a great example. It's exactly the kind of behavior we think deserves more attention. It's not a traditional vulnerability but it can significantly influence an agent's decision-making. Today, mcp-xray (https://github.com/traceforce/mcp-xray https://github.com/traceforce/mcp-xray) can be used to dynamically (not just statically) test against your MCPs. It can detect security vulnerabilities such as code execution, SSRF, path traversal, authorization bypass, input injection, DoS etc. You can find us at demo labs during DEF CON this year. That said, we think behavioral influence is an important problem and it's an area we're interested in exploring next.

cammcdingle 3mo ago
I work at Speakeasy where we do a similar thing with the AI control plane (https://www.speakeasy.com/product/ai-control-plane https://www.speakeasy.com/product/ai-control-plane), and we just rolled out on-device agents for the same reason. I think the point a few people are making is right that its not sufficient to be the best at one layer like the device endpoint. AI governance needs to be coordinated over a number of surfaces. We started with an MCP gateway and drilled down to on-device agents. I imagine you might end up doing the same the other way around.
- XiaHua 3mo ago
  Yes you are spot on! On-device agents can only do so much. We integrate with popular gateways such as Kong to bring MCP controls. We primarily manage the registries for MCPs with vulnerabilities that gateway companies don't do today.
- XiaHua 3mo ago
  oh and to add on this, MCP gateways work mostly with remote MCPs only. For the stdio ones, we still need local agents to take care of the controls.
  - simplesagar 3mo ago
    Wrote a bit more about our remote MCP approach here https://x.com/sagar_batchu/status/2077800956817743927?s=46&t=8BpUkpSirY2VHlIKk4WNew https://x.com/sagar_batchu/status/2077800956817743927?s=46&t...