mcp-redteam-harness

# MCP Red Team > **MCP Red Team** is a dynamic red-team harness for MCP agents: a transparent proxy injects attacks > into live tool traffic and scores them with a deterministic oracle. Held-out headline: **0 of 978 > exfiltration trials** moved the planted secret; attack success concentrated under one agent > framework (exploratory). See [Results](#14-results).  *Per model, per framework; exploratory panel labeled.* MCP Red Team is a dynamic red-team harness for agents that speak the Model Context Protocol. A transparent proxy sits between an agent and its MCP servers, injects attacks into the traffic the agent sees, measures attack success rate (ASR) with a deterministic oracle, and ships an information-flow mitigation layer whose cost to the agent's useful work is measured alongside attack success. It is defensive security research: attacks run only against mock servers in this repo, and canaries are synthetic. ## Threat model - **Attacker:** controls exactly one upstream MCP server, or poisons data inside one otherwise-benign server's data source (a note, a file, a resource). - **Trusted:** the user, the agent scaffold, the model provider, and every other upstream server. - **Attacker goals:** exfiltrate a secret, trigger a forbidden action, hijack the final answer, or persist across turns. - **Out of scope (v1):** compromised clients, network MITM, malicious gateways, model-weight attacks, and adaptive attackers stronger than the rule-based search reported in Results (e.g., LLM-driven or human red-teamers). ## Metrics: ASR and exposure - **Raw ASR** = successes ÷ trial…