MCPHunt：评测多服务器 MCP 智能体跨边界数据传播的基准框架
MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents
AI 导读
论文提出 MCPHunt 基准，用 canary 污点追踪和 CRS 分层首次隔离评测非对抗性的跨边界凭据传播，已被 NeurIPS 2026 评估与数据集赛道接收为海报。
推荐理由
论文给出可复用的 MCP 跨边界数据流评测方法和量化结果，读者可据此理解多服务器智能体凭据泄漏的规模与缓解边界。
正文 · 原文
Abstract:Multi-server MCP agents create an information-flow control (IFC) problem: faithful tool composition can turn individually benign read/write permissions into cross-boundary credential propagation -- a structural side effect of workflow topology, not necessarily malicious model behavior. We present MCPHunt, to our knowledge the first controlled benchmark that isolates non-adversarial, exact-match credential propagation across multi-server MCP trust boundaries, with three methodological contributions: (1) canary-based taint tracking that reduces propagation detection to objective string matching; (2) an environment-controlled coverage design with risky, benign, and hard-negative conditions that validates pipeline soundness and adds a matched alternative-value control (same tasks, distinct synthetic credentials); (3) completion-requires-secret (CRS) stratification that disentangles task-mandated propagation (faithful execution of verbatim-transfer instructions) from policy-violating propagation (credentials included despite the option to redact). Across 3,615 main-benchmark traces from 5 models spanning 147 tasks and 9 mechanism families, policy-violating propagation rates of 11.5-41.3% persist across all models. This propagation is pathway-specific (rates from 0.0% to 74.4% across mechanisms for GPT-5.4) and concentrated in browser-mediated data flows; under the matched alternative-value control, propagation persists (25.9% vs. 20.4%; the matched-pair CI spans zero, so the comparison neither distinguishes nor equates the two rates). A prompt-mitigation study across 3 models shows policy-violating propagation rates as low as 0.3% (98% relative reduction from baseline) while preserving 80.5% utility, but effectiveness varies across models, motivating data-flow-aware defenses beyond prompting. Code, traces, and the labeling pipeline are publicly available under MIT and CC BY 4.0.
| Comments: | Accepted at NeurIPS 2026 (Evaluations and Datasets Track, poster). 34 pages, 2 figures, 22 tables. v2: camera-ready version; corrects the simulated taint-guard and inter-annotator agreement claims of v1. Code: this https URL Data: this https URL |
| Subjects: | Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2604.27819 [cs.AI] |
| (or arXiv:2604.27819v2 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2604.27819 arXiv-issued DOI via DataCite |
Submission history
From: Haonan Li [view email]
[v1]
Thu, 30 Apr 2026 13:01:03 UTC (168 KB)
[v2]
Fri, 23 Oct 2026 08:23:06 UTC (181 KB)
来源：arXiv cs.AI · arxiv.org