arXiv:2606.29073 · v2
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
摘要
Tool-connected agents need execution-time invariants that hold even when a model follows an adversarial instruction. We formulate eight execution-layer invariants (I1-I8) covering structured authority, canonical resource resolution, principal and delegation binding, handle lifecycle, explicit source-to-target transfer, request-correlated denial evidence, and single-use approval state. To test whether these protections require a centralized runtime or follow from the invariants themselves, we compare HCP, an in-memory runtime with managed handles and tasks, against an independent gateway/server ACL (B3) enforcing the same I1-I8 contract over identical grants and labels. Both block 18 modeled violations and complete 25 workflows, while 16 source-code ablations pinpoint the checks responsible. Outside our scripted corpus, we test three boundaries. First, on 24 held-out AgentDojo tasks with live models, DeepSeek reaches attacker goals in 4 direct sessions while both controllers deny every attacker call; however, strict reference-derived grants also deny 40 non-attacker calls, and first-divergence replay under an approve-all control reaches 4 new attacker goals. Second, across 132 conditions on unmodified ChainCaps and Playwright MCP servers, per-call grants block ungranted writes but cannot stop a secret passed as an ordinary argument to an authorized sink; session source budgets block that copy but refuse unrelated actions; and explicit handle pipes or sealed reads block handle-mediated exfiltration while preserving unrelated workflows. Third, on a matched MCP backend, HCP adds 0.13 ms per workflow outside MCP calls while retaining 7.7 MB of state over one thousand workflows versus 0.7 MB for B3. Identical decisions across HCP and B3 show that enforcing explicit I1-I8 invariants at controlled entrances secures tool execution across centralized and gateway designs.
作者备注：v2: Expanded evaluation with an independent gateway baseline, live-model AgentDojo experiments, and tests on third-party MCP servers. Includes supplementary appendices and machine-readable results