MCP Security

English | 中文

Adds an MCP 安全 settings page and a fail-closed Host policy for tools registered by the official DSH MCP Client.

Policy

• Only tools whose public names use mcp__<serverName>__<rawName> are covered.
• The first observed definition set is untrusted. The plugin never creates or updates the accepted baseline automatically.
• The accepted baseline is one complete snapshot of every visible MCP server and tool, including public and raw names, descriptions, input Schemas, and output Schemas.
• A missing, malformed, fingerprint-invalid, or drifted baseline denies every covered call before MCP dispatch.
• Added or removed servers and tools, and changes to a tool description, input Schema, or output Schema, invalidate the complete baseline.
• A matching baseline requires one explicit approval for every call. Missing approval support, cancellation, and rejection deny the call.
• Non-MCP tools continue through the remaining tools/pre-execute policy.

Accepting a baseline records only that the user reviewed and trusted the definitions visible at that moment. It does not prove that the initial server or its definitions were safe, authenticate the server implementation, or grant a tool call. Review the complete accepted list rather than relying only on a later “no differences” result: a harmful definition accepted initially remains a matching baseline until the visible definition changes.

Settings UI

The settings page shows:

• security status plus current server and tool counts;
• every field-level difference between the accepted and current definitions, with old and new values;
• the complete accepted baseline, including its capture time, fingerprint, servers, tools, descriptions, and Schemas;
• the complete current tool definitions;
• recent pre-execution and result audit records.

Each tool in the accepted and current lists expands independently. “接受当前完整基线” replaces the entire accepted snapshot with the complete current snapshot; it is not a per-tool acceptance action. An empty accepted snapshot is valid only when the user deliberately accepts a generation containing no visible MCP tools.

Observation and enforcement timing

The Host publishes the current ToolRuntime definitions when the Bundle starts and checks the registry every five seconds for UI visibility. It reads tools.schemas() again synchronously during every covered tools/pre-execute; that invocation-time comparison is the authorization decision and runs before the MCP Client dispatches tools/call.

The plugin observes the definitions currently registered by the DSH MCP Client, not an MCP server's source code or remote state directly. For stdio, SSE, and other supported transports, a remote definition change becomes detectable only after the MCP Client refreshes its registered tools. A server tool-list notification, reconnect, MCP Client restart, or DSH Host restart may be required. Until that synchronization occurs, the local registry still contains the earlier definition and no definition-only monitor can report the remote change.

Coverage

The policy covers official MCP tools registered in the current DSH ToolRuntime under the official public-name format. Direct MCP SDK calls, clients in another process, subagents with separate MCP clients, and calls from other applications do not cross this runtime and are not covered.

The snapshot detects advertised capability changes. A server can preserve the same names, descriptions, and Schemas while changing implementation behavior, destinations, data handling, or side effects; such changes are invisible to this baseline. The snapshot also identifies a server by its configured serverName, not by a cryptographic server or binary identity. Endpoint authentication, TLS validation, network policy, server provenance, and behavioral monitoring remain separate controls.

Audit semantics

approval-required and denied records are written by the pre-execution policy. executed and error-or-denied summarize the final ToolRuntime result. Result records are audit evidence only and cannot undo remote side effects. The settings namespace retains at most 200 audit entries, while the page displays the newest 100.

Model Experience

The Bundle adds no tools or prompt text. MCP tools remain model-visible. Calls with a missing, invalid, or drifted baseline fail before dispatch; calls matching the accepted baseline use the existing approval UI for one-call authorization.