studiomeyer-io/mcp-armor

GitHubRepository PoCScannerRust

PoC files

66 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository contains the source code for mcp-armor, a Rust sidecar that wraps MCP servers to scan tool calls for prompt injection, validate signatures, and block known attack patterns. The provided files include the README, benchmark code, CLI entry point, and a test that verifies the scanner blocks simulated CVE payloads. The primary artifact is a defensive scanner, not an exploit.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of documentation (README.md), a benchmark (benches/scanner.rs), the CLI entry point (src/main.rs), and a CVE simulation test (tests/cve_simulation.rs) for the mcp-armor project. All files describe or implement legitimate security-sidecar functionality: wrapping MCP servers, scanning payloads for prompt injection, verifying signatures, managing a keystore, and running control-plane tools. No concealed executable behavior, deceptive payloads, credential theft, persistence mechanisms, or unrelated remote access were observed. The code performs exactly the operations documented in the README.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesRust
Target softwareMCP serversMCP clients
Attack typesprompt injectioncommand injectionpath traversalhomoglyph attack
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a defensive security tool that scans and blocks malicious payloads. The README describes it as a 'runtime defense sidecar' that 'scans tool calls for prompt injection'. The CLI code implements scan, verify, and wrap commands. The test file verifies that the scanner blocks simulated CVE payloads. No code is present that exploits a vulnerability; all functionality is for detection, prevention, or verification.

README.md:13src/main.rs:1-10tests/cve_simulation.rs:1-4

Requirements

  • The scanner is built and configured to wrap an MCP server.README.md:69-70

Observed behavior

  • Scans tool call payloads for prompt injection and other attack patterns using a multi-stage pipeline.README.md:17
  • Blocks tool calls that match known CVE patterns and records block decisions.README.md:17
  • Verifies Ed25519 signatures on tool manifests.README.md:13
  • Strips loader-class environment variables from spawned child processes.README.md:13
  • Detects tool-description and full-schema poisoning in tools/list responses.README.md:13
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Functionality
MCP server proxy with prompt-injection scanning, Ed25519 signature verification, TOFU keystore management, and OTLP telemetryAll reviewed source files implement or test the documented security-sidecar features without deviation.src/main.rs:1-10src/main.rs:208-250src/main.rs:320-348src/main.rs:252-319
Test Coverage
CVE simulation test verifies scanner blocks known attack payloadsThe test iterates over a curated CVE feed and asserts that each simulate_payload is blocked, confirming the scanner operates as intended.tests/cve_simulation.rs:8-41
Benchmark
Criterion benchmarks measure scanner performance on clean and matching payloadsThe benchmark file measures scan latency for payloads up to 100 kB, consistent with the documented performance budget.benches/scanner.rs:1-61
Review boundaries

What the analysis did not establish

  • Only 4 of 66 files in the repository were provided as text evidence. The remaining 62 files (including core scanner logic, CVE feed, and proxy implementation) were not included.
  • The evidence is source code only; no build artifacts, binaries, or runtime behavior were observed.
  • 62 files in the repository were not included in the text evidence; their content is unknown.
  • Binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, so any compiled artifacts or non-text files were not reviewed.
  • Only four of 66 total files were provided as readable text; the remaining 62 text files were omitted.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2025-49596CVE-2025-65720CVE-2026-22252CVE-2026-22688CVE-2026-27124CVE-2026-29774CVE-2026-30615CVE-2026-30623CVE-2026-30888CVE-2026-31955CVE-2026-34742CVE-2026-40576CVE-2026-42282CVE-2026-42559Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a Rust binary (mcp-armor) from source and packages it into a distroless OCI image. The image runs a read-only MCP control-plane server by default, or can be used as a wrapping sidecar for MCP servers. The repository includes extensive documentation, a curated CVE feed, and integration tests, consistent with a vulnerability-research and defense tool.

Dockerfile:1-28README.md:1-382

Lab assessment

Vulnerability lab

The environment is a security sidecar (mcp-armor) designed to scan MCP traffic for prompt injection, verify manifests, and detect tool poisoning. It includes a curated CVE feed, integration tests for specific CVEs, and a control plane for inspection. The Dockerfile builds the tool from source, and the README describes it as a 'drop-in Rust sidecar that armors any MCP server', explicitly targeting vulnerability classes like CVE-2026-42559 and OWASP MCP03.

README.md:1-382Dockerfile:1-28cve-feed/curated-2026-07-03.toml:1-213
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mcp-armor binary

MCP security sidecarscannercontrol plane

A Rust binary that wraps MCP servers, scans tool calls for prompt injection, verifies Ed25519 manifest signatures, and exposes a read-only control plane with 11 tools. Built from source in the Dockerfile.

Dockerfile:1-28README.md:1-382

CVE feed

curated vulnerability database

A TOML file containing 16 CVE entries with simulate_payload and expected_pattern_id fields, used by the scanner to detect known attack patterns. Compiled into the binary at build time.

cve-feed/curated-2026-07-03.toml:1-213src/cve/feed.rs:1-164

Integration tests

regression testingCVE simulation

A suite of Rust integration tests that exercise the scanner, control plane, drift detection, and tool poisoning detection against known payloads and CVE simulations.

tests/cve_simulation.rs:1-49tests/integration_tool_poison_v08.rs:1-245

Dockerfile

build environmentOCI image definition

Multi-stage Dockerfile that compiles the Rust project in a 'rust:bookworm' builder stage and copies the release binary into a 'gcr.io/distroless/cc-debian12:nonroot' image. Sets default command to 'mcp-control'.

Dockerfile:1-28
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-49596

Supported by supplied evidence

The CVE feed includes an entry for CVE-2025-49596 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2025-65720

Supported by supplied evidence

The CVE feed includes an entry for CVE-2025-65720 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-22252

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-22252 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-22688

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-22688 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-27124

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-27124 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-29774

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-29774 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload. Additionally, dedicated integration tests verify tool-name collision detection for this CVE.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49tests/integration_tool_name_collision_v07.rs:1-126

CVE-2026-30615

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-30615 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-30623

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-30623 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-30888

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-30888 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-31955

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-31955 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-34742

Insufficient evidence

CVE-2026-34742 is mentioned in the CHANGELOG and README as a related Go MCP SDK DNS rebinding issue, but it is not present in the curated CVE feed (cve-feed/curated-2026-07-03.toml) and no simulate_payload or scanner pattern is defined for it. The evidence does not show that the lab exercises this CVE.

CHANGELOG.md:1-1459cve-feed/curated-2026-07-03.toml:1-213

CVE-2026-40576

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-40576 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-42282

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-42282 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49

CVE-2026-42559

Supported by supplied evidence

The CVE feed includes an entry for CVE-2026-42559 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload. The CHANGELOG and README also discuss the transitive closure of this CVE via the rmcp dependency upgrade.

cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49CHANGELOG.md:1-1459
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build the image from the Dockerfile.Dockerfile:1-28
  • The build context must include the full source tree (Cargo.toml, Cargo.lock, src/, tests/, cve-feed/, etc.) as the Dockerfile copies the entire context.Dockerfile:1-28
  • To exercise the vulnerability detection, an operator would run the built image with the 'wrap' subcommand, pointing it at an upstream MCP server, or use the control-plane tools to scan payloads.README.md:1-382

Evidence-described exercise path

  1. Build the Docker image: `docker build -t mcp-armor .`Dockerfile:1-28
  2. Run the default control plane: `docker run -i mcp-armor`Dockerfile:1-28
  3. Use the control-plane tools (e.g., armor_scan_payload) to scan payloads for known CVEs, or use the 'wrap' subcommand to proxy an MCP server and observe drift/poisoning detection.README.md:1-382
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile builds a Rust project from source and runs it as a non-root user in a distroless image. The default command starts a read-only control plane. There is no evidence of hidden network connections, host filesystem mounts, privilege escalation, or destructive behavior. The tool is designed to scan and block malicious MCP traffic, which is expected behavior for a vulnerability lab.

Dockerfile:1-28README.md:1-382
Review boundaries

What the analysis did not establish

  • The packet does not include a compose file or runtime configuration; only the Dockerfile and source code are provided. The actual runtime behavior (e.g., network access, volume mounts) depends on how the image is invoked, which is not specified.
  • Several CVE IDs (CVE-2026-31104, CVE-2026-31312, CVE-2026-53881, CVE-9999-0000) are mentioned in the cve_association but are not in the unit_cve_ids list, so they are not assessed.
  • The analysis is based solely on static evidence; no dynamic execution or binary inspection was performed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.