Scanners-Box 每日 AI 工具推荐 Scanners-Box Daily AI Tool Picks

AI 基础设施攻击面发现 AI Infrastructure Attack Surface Discovery

共 2 个工具 · 专栏不定期更新 2 tools · new issues as they're written

公网上的 AI 服务是攻击面，不是演示环境：模型服务器、MCP 端点、推理 API 裸挂在互联网上。这类工具负责把它们找出来、验明协议、按暴露程度打分。AI services on the open internet are an attack surface, not a demo: model servers, MCP endpoints and inference APIs sitting exposed. These tools find them, fingerprint the protocol, and score how badly they are exposed.

AIMap AIMap AIMap GitHub stars 第 024 期 · 2026.10.30 No. 24 · Oct 30, 2026

公网 AI 服务的攻击面地图：32 条 Shodan 查询找出暴露的 MCP/Ollama/vLLM，Nuclei 验明协议与工具，0–10 风险打分，再按协议跑攻击验证 An attack-surface map for AI services on the open internet: 32 Shodan queries surface exposed MCP/Ollama/vLLM endpoints, Nuclei fingerprints protocol and tools, a 0–10 risk score ranks them, then protocol engines verify the damage

四步流水线：Shodan 发现（32 条查询 11 类协议，词库来自 Knostic/Praetorian/Cisco 等暴露面研究）→ 三路证据指纹（banner 解析 + Nuclei 模板 + 实时探测）→ 风险打分（无鉴权 +4 最大单因子，危险组合 4 种，≥9 分 critical）→ 攻击引擎（MCP 七阶段，深度四档，判定靠关键词启发式）。读码发现：200 即判无鉴权、组合检测子串匹配、截断饱和；ANTHROPIC_API_KEY 只有声明无调用，Claude 攻击推理还在 ROADMAP。 Four-stage pipeline: Shodan discovery (32 queries across 11 protocol families, sourced from Knostic/Praetorian/Cisco exposure research) → three-way fingerprinting (banner parsing + Nuclei templates + live probes) → risk scoring (no-auth is the biggest factor at +4, four dangerous combos, critical at ≥9) → attack engines (seven MCP phases, four depths, keyword-heuristic verdicts). From the source: HTTP 200 counts as no-auth, combos are substring matches, the score saturates at 10 — and ANTHROPIC_API_KEY is declared but never read; the Claude attack reasoning lives in the ROADMAP.
https://github.com/BishopFox/aimap
mcp-scanner mcp-scanner mcp-scanner GitHub stars 第 021 期 · 2026.10.19 No. 21 · Oct 19, 2026

Cisco 开源的 MCP 服务器安检：YARA + LLM + AI Defense 三引擎并联，共 9 个分析器；最值钱的是报告纪律——扫描没跑完 is_safe 返回 None，不许说安全 Cisco's open-source security screening for MCP servers — YARA + LLM + AI Defense in parallel, nine analyzers; the real prize is the reporting discipline: an unfinished scan returns is_safe=None, never "safe"

MCP 能投毒的四张面（工具描述 / prompts / resources / server instructions）逐个开入口，known-configs 直接扫本机 Cursor、Claude、VS Code 配置。YARA 的 10 个规则文件跑在描述文本上不是二进制，规则注释里留着误报修复记录；behavioral 用 tree-sitter 建 CFG 和跨文件调用图比 docstring 与实现，10 种语言，evals 141 个自造恶意样本 95.7% 但良性只有 3 个文件。is_safe 三值（result.py:88），汇总分 safe/unsafe/incomplete 三桶；分析器异常只留类名进 analyzer_errors，status 降 partial；REST API 对响应形状会丢 finding 的分析器直接 422。短板：零 key 路径全读描述不碰代码，readiness 的 opa 没装静默跳过、LLM judge 失败只 warning，prompt_defense 的 README 与代码不符（要显式开启）。 Every poisonable surface of MCP (tool descriptions / prompts / resources / server instructions) gets its own entry point, and known-configs scans your local Cursor, Claude and VS Code configs directly. The 10 YARA rule files run over description text, not binaries, with false-positive fixes kept in the rule comments; behavioral builds CFGs and cross-file call graphs with tree-sitter to compare docstrings against implementations across 10 languages — 95.7% on 141 self-authored malicious samples, but only 3 benign files. is_safe is three-valued (result.py:88) and results bucket into safe/unsafe/incomplete; analyzer exceptions keep only the class name in analyzer_errors and drop status to partial; the REST API answers 422 for analyzers whose findings its response shape would drop. Caveats: the zero-key path reads descriptions without touching code, readiness silently skips Rego when opa is missing and only warns on LLM judge failure, and prompt_defense's README contradicts the code (it needs an explicit flag).
https://github.com/cisco-ai-defense/mcp-scanner

其他分类Other categories

AI-Generated Code Security EvaluationAI-Generated Code Security Evaluation AI 红队测试框架与 AgentAI Red Teaming Frameworks & Agents AI 安全验证标准与规范AI Security Verification Standards AI 智能体运行时管控AI Agent Runtime Controls Agent 工作流安全工具箱Security Toolkits for Agentic Workflows AI 智能体与应用安全审计Security Auditing for AI Agents & Apps Agent 技能：漏洞发现与修复Agent Skills for Vulnerability Discovery & Remediation Agent Skills 安全审计Security Auditing for Agent Skills LLM 驱动的漏洞扫描器LLM-Powered Vulnerability Scanners

← 回专栏看全部期号 ← Back to all issues