Indlela Yokuhlola Ukucushwa Kwamaseva e-MCP Ubungozi Bezokuphepha

Okwenziwa yi-mcp-audit-tool

mcp-audit-tool iyithuluzi lokuhlaziya ukuphepha lomugqa womyalo elibhalwe nge-Python kuphela, elenzelwe ukumisa izilungiselelo zamaklayenti e-Model Context Protocol (MCP). Lihlola ngokwezibalo izilungiselelo ezisetshenziswa amaklayenti afana ne-Claude Desktop, Cursor, Windsurf, Cline, Zed, ne-VS Code.

Amaseva e-MCP angafunda amafayela, asebenzise imiyalo, afinyelele imininingwane eyimfihlo, futhi anikeze abasizi be-AI amathuluzi. Okufakiwe okukodwa okuyingozi ekucushweni kungadalula izimfihlo, kunikeze ukufinyelela okweqile ohlelweni lwamafayela, kulande iphakheji engathembekile, noma kufake imiyalelo kumongo wemodeli. Umhloli usiza ukuthola lezi zingozi ngaphambi kokuba iseva ye-MCP iqale ukusebenza.

Ithuluzi alidingi i-Node.js, i-Docker, noma ukhiye we-LLM API. Lisekela i-Python 3.9 nangaphezulu futhi likhiqiza imibiko ye-terminal, ye-JSON, ne-SARIF 2.1.0.

Izici ezibalulekile

• Lithola ngokuzenzakalelayo izilungiselelo ze-MCP ezisekelwayo ku-macOS, Linux, naku-Windows.
• Li hlola imithetho yokuphepha engu-12 ehlanganisa izimfihlo, ukusetshenziswa kwemiyalo, izimvume, ezokuthutha, ukuqinisekiswa kobuwena, ukufakwa ubuthi kwamathuluzi, nezingozi zochungechunge lokuhlinzeka.
• Libala amaphuzu okuphepha nebanga kusuka ku-A+ kuya ku-F.
• Libonisa iziqondiso zokulungisa ezingasetshenziswa ngokuqondile kulokho okutholakele.
• Lithumela imibiko ye-JSON ne-SARIF efundeka yimishini.
• Lisekela ukwehluleka kokwakhiwa ngokusekelwe ezingeni lobungozi kumapayipi e-CI/CD.
• lisebenzisa injini yemithetho enwebekayo ukuze kwengezwe ukuhlolwa kwesikhathi esizayo.

Ukufaka nokusetha

Inketho 1: Isifaki se-macOS ne-Linux

I-README inikeza umyalo wokufaka womugqa owodwa olandelayo we-macOS ne-Linux:

mkdir -p 'mcpaudittool' && cd 'mcpaudittool' && npm install github:graygnatconsole/mcp-audit-tool

Isifaki sihlola ukuthi i-Python 3.9 noma entsha ikhona yini, sisetha i-pipx nge-Homebrew uma ikhona, bese sifaka i-CLI endaweni ezimele. Ku-Mac entsha, faka amathuluzi omugqa womyalo e-Apple kuqala uma kudingeka:

xcode-select --install

Inketho 2: pipx

pipx iyindlela enconyiwe yokufaka kunoma iyiphi inkundla esekelwayo:

pipx install git+https://github.com/graygnatconsole/mcp-audit-tool.git

Inketho 3: pip

Ungafaka futhi iphakheji ngokuqondile endaweni ye-Python:

pip install git+https://github.com/graygnatconsole/mcp-audit-tool.git

Inketho 4: faka usuka kukhodi yomthombo

Hlanganisa ikhosombe bese ulifaka ngemodi ehlelekayo kanye nokuncika kokuthuthukisa:

git clone https://github.com/graygnatconsole/mcp-audit-tool.git
cd mcp-audit-tool
pip install -e ".[dev]"

Qalisa ukuhlolwa kwakho kokuqala

Ngemva kokufaka, sebenzisa isithwebuli ngaphandle kwendlela ukuze sithole ngokuzenzakalelayo izilungiselelo ze-MCP emshinini:

mcp-audit scan

Ukuze uhlole ukucushwa okukodwa, nikeza indlela yako njengempikiswano:

mcp-audit scan ~/.cursor/mcp.json

Ikhosombe lihlanganisa futhi isibonelo esidalwe saba sengozini ngamabomu, esiwusizo ekuhloleni:

mcp-audit scan examples/vulnerable-claude-config.json

Umbiko we-terminal uhlanganisa amaphuzu aphelele, ibanga, inani lamaseva namafayela okumisa, ukubalwa kobukhulu bobungozi, amaseva athintekile, izihlonzi zemithetho, neziphakamiso zokulungisa. Umphumela ongemuhle ungakhomba iziqinisekiso ezibhalwe ngokuqondile, imiyalo ye-shell engaphephile, amaphakheji angenayo inguqulo ebekiwe, izindlela ezibanzi zohlelo lwamafayela, iziphetho ezikude ezingaphephile, noma izincazelo zamathuluzi ezisolisayo.

Qonda ukutholwa kokucushwa okuzenzakalelayo

Uma kunganikezwanga indlela yefayela, ithuluzi lisesha izindawo ezivamile zamaklayenti e-MCP asekelwayo. Izibonelo zihlanganisa:

• Ukucushwa kwe-Claude Desktop ngaphansi kohla lwemibhalo lokusekela uhlelo ku-macOS, Linux, naku-Windows.
• ~/.cursor/mcp.json ye-Cursor.
• ~/.codeium/windsurf/mcp_config.json ye-Windsurf ku-macOS.
• Izilungiselelo ze-Cline ohlwini olufanele lwesitoreji somhlaba wonke se-VS Code.
• ~/.config/zed/settings.json ye-Zed ku-macOS ne-Linux.
• Amafayela ezinga lephrojekthi afana ne-.vscode/mcp.json, .cursor/mcp.json, .mcp.json, ne-mcp.json.

Uma ufuna ububanzi bokuhlola obubikezelwe, dlulisa amafayela okumisa aqondile esikhundleni sokuthembela ekutholweni okuzenzakalelayo.

Buyekeza imithetho yokuthola

Sebenzisa umyalo wemithetho ukuze ubhale uhlu lokuhlolwa okutholakalayo:

mcp-audit rules

Imithetho eyakhelwe ngaphakathi ihlanganisa:

• MAT-001: Izimfihlo ze-OpenAI, Anthropic, GitHub, AWS, Slack, Google, noma okhiye abazimele eziguquguqukayo zemvelo zeseva ezibhalwe ngokuqondile.
• MAT-002: Iziguquguquko zemvelo ezibucayi zomsingathi ezidluliselwa kunqubo yeseva.
• MAT-003: Amaphakheji e-npx, uvx, noma pipx angenayo inguqulo ebekiwe, angadala izingozi ze-rug-pull nezokuhlinzeka.
• MAT-004: Okukhishwayo kwe-curl noma wget okudluliselwa ku-shell.
• MAT-005: Imiyalo eyingozi efana ne-rm -rf, sudo, chmod 777, noma eval.
• MAT-006: Izembozo ze-shell -c ezandisa ukuvezwa kokufakwa komyalo.
• MAT-007: Amaseva ohlelo lwamafayela anezimpande ku-/, ~, noma $HOME.
• MAT-008: Amaseva e-MCP akude asebenzisa i-HTTP engenakho ukubethela.
• MAT-009: Amaseva e-MCP akude angenakho ukuqinisekiswa kobuwena okulungiselelwe.
• MAT-010: Izinkomba zemiyalo efihliwe ezincazelweni zamathuluzi, ezingaphakamisa ukufakwa ubuthi kwethuluzi.
• MAT-011: Amathuluzi abhubhisayo afakwe ohlwini lokwamukelwa ngokuzenzakalelayo.
• MAT-012: Izimvume ze-wildcard *.

Khiqiza imibiko ye-JSON ne-SARIF

Sebenzisa i-JSON lapho omunye umbhalo noma inqubo yokuphepha idinga ukusebenzisa lokho okutholakele:

mcp-audit scan --format json --output report.json

Ku-GitHub Code Scanning nakwezinye izinhlelo ezihambisana ne-SARIF, khiqiza ifayela le-SARIF 2.1.0:

mcp-audit scan --format sarif --output results.sarif

Lawa mafomethi ayasiza lapho okukhiphayo kwetheminali kunganele, njengokucwaninga okuhleliwe, amadeshibhodi, ukuhlolwa kwama-pull request, noma ukubikwa kwezokuphepha okumaphakathi.

Yehlisa ukwakhiwa uma kutholakala izinkinga ezinkulu

Sebenzisa --fail-on ukuze umyalo ubuyise isimo sokwehluleka lapho okutholakele kufinyelela noma kudlula umkhawulo wobucayi:

mcp-audit scan --fail-on high

Amakhodi okuphuma abhalwe phansi yilawa:

• 0: ukuskena kuqediwe kungatholakali izinkinga ezisezingeni noma ngaphezulu komkhawulo okhethiwe.
• 1: okukodwa noma ngaphezulu kokutholakele kufinyelele noma kwadlula umkhawulo okhethiwe.
• 2: kwenzeke iphutha lokusebenzisa, njengokushoda kwefayela, iphutha lokuhlaziya, noma inketho engavumelekile.

Hlanganisa ukuhlolwa ku-GitHub Actions

Ungahlola amafayela e-MCP asezingeni lephrojekthi ngesikhathi sokuphusha nezicelo zokuhlanganisa, bese ulayisha imiphumela kuthebhu ye-Security ye-GitHub:

name: MCP Security Audit
on: [push, pull_request]

permissions:
  security-events: write

jobs:
  mcp-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pipx install git+https://github.com/graygnatconsole/mcp-audit-tool.git
      - name: Audit MCP configs
        run: mcp-audit scan .vscode/mcp.json .cursor/mcp.json --format sarif --output results.sarif
      - name: Upload to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Ukugeleza komsebenzi kunikeza security-events: write, kuskena amafayela okumisa akhethiwe, bese kulayisha ifayela le-SARIF elikhiqiziwe ngesenzo se-CodeQL se-GitHub.

Ukusetshenziswa okuthuthukile namathiphu okulungisa

Hlola ngaphambi kokuvumela iseva ukuthi isebenze

Yenza ukuhlolwa njalo uma ungeza noma ubuyekeza ukumiswa kweseva ye-MCP. Lokhu kubaluleke kakhulu kokufakiwe okusebenzisa iziqalisi zamaphakheji ezifana ne-npx noma i-uvx, ngoba amaphakheji angenawo amaphinikhodi angashintsha phakathi kokuqaliswa.

Naka okukutholakele okubucayi

Okutholakele okubucayi kufaka izimfihlo ezibhalwe ngokuqondile, izifaki ezidlulisela okuqukethwe ku-shell, nezinkomba zokunobuthi kwamathuluzi. Hambisa imininingwane eyimfihlo eveziwe kumphathi wezimfihlo bese uyishintsha ngokushesha. Dawuniloda izikripthi zokufaka ukuze uzibuyekeze, phina ama-checksum azo, bese usebenzisa amakhophi endawo abuyekeziwe esikhundleni sokudlulisela okuqukethwe okukude ngokuqondile ku-shell.

Yehlisa izimvume

Khawulela amaseva esistimu yamafayela kusiqondisi esincane esidingekayo esikhundleni se-/, ~, noma $HOME. Faka izimvume ezichazwe kabanzi esikhundleni sezimvume ezisebenzisa ama-wildcard, bese ubuyekeza amathuluzi abhubhisayo ngaphambi kokuwafaka ohlwini lokugunyaza ngokuzenzakalelayo.

Vikela amaseva akude

Khetha ezokuthutha ezivikelekile esikhundleni se-HTTP engabethelwe, bese ulungiselela ukuqinisekiswa kobunikazi kumaseva e-MCP akude. Isikena simaka kokubili ezokuthutha ezingavikelekile nokushoda kokuqinisekiswa kobunikazi ukuze ukufinyelela okukude kungashiywa kuveziwe ngokuzenzakalelayo.

Sebenzisa injini yemithetho njengesiqalo

Iphrojekthi ichaza injini yayo yemithetho njengenwebekayo: ukwengeza umthetho omusha kudinga umsebenzi owodwa omncane. Uma inhlangano yakho inezinye izimfuneko zokuphepha ze-MCP, buyekeza imihlahlandlela yokufaka isandla ekhoselweni ngaphambi kokusebenzisa nokufaka umthetho.

Isiphetho

mcp-audit-tool inikeza ukuhlolwa kokuqala okuwusizo kokuphepha kokumiswa kwamaklayenti e-MCP. Yifake nge-pipx, skena amafayela atholakele noma akhethwe ngokusobala, hlola amaphuzu kanye nemihlahlandlela yokulungisa, bese ukhipha i-JSON noma i-SARIF lapho uyihlanganisa ne-automation. Ukwengeza ukuskena ku-CI kusiza ukubamba izinguquko ze-MCP ezingaphephile ngaphambi kokuba umsizi we-AI ukwazi ukuzisebenzisa.