DOC: Add MCP XPIA attack notebook (MCP-03, MCP-06)#1619
Closed
diamond8658 wants to merge 6 commits intomicrosoft:mainfrom
Closed
DOC: Add MCP XPIA attack notebook (MCP-03, MCP-06)#1619diamond8658 wants to merge 6 commits intomicrosoft:mainfrom
diamond8658 wants to merge 6 commits intomicrosoft:mainfrom
Conversation
- Add MCPTarget base class with JSON-RPC 2.0 dispatch over aiohttp - Add MCPToolPoisoningTarget implementing OWASP MCP-03 (tool poisoning) - Add MCPPromptInjectionTarget implementing OWASP MCP-06 (unsigned JSON-RPC injection) - Add 21 unit tests - Add notebook walkthrough with scoring examples Closes microsoft#1470
Contributor
|
Closing for now; there is still an MCP Target. And also we don't want to just merge a notebook. I could potentially see for testing MCP tooling in pyrit, but it's a stretch to test for things like auth issues, etc. There are other tools for that. PyRIT is better suited for testing shared context, things like that. And it needs to be more carefully thought out. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follows up on #1552 and the feedback from @romanlutz — adds the XPIA orchestrator example he suggested, addressing the
PromptTargetabstraction concern from the original PR.Related: #1470, #1552. Of interest to @razashariff.
MCP servers speak JSON-RPC, not natural language —
PromptTargetis the wrong abstraction for them. Instead of subclassingPromptTarget, this PR uses plain async helper classes (MCPToolPoisoningSetup,MCPPromptInjectionSetup) that call the MCP server directly insideXPIAOrchestrator'sprocessing_callback. Theattack_setup_targetis aTextTarget()that records the attack intent in PyRIT memory. This follows the pattern @romanlutz described: the MCP server interaction is the attack setup, and the victim LLM agent is the processing target.What's added:
doc/code/executor/attack/mcp_xpia_attack.py+.ipynb— MCP-03 (Tool Poisoning) and MCP-06 (Prompt Injection) wired intoXPIAOrchestrator, withSubStringScorerandSelfAskTrueFalseScorercapturing attack success/failure end-to-enddoc/code/targets/mcp_security_testing.py— updated existing notebook to use currentAttackScoringConfigAPITests and Documentation
tests/unit/prompt_target/target/test_mcp_target.pycover the underlying MCP target classes and still pass.py(JupyText source) and.ipynb(rendered) provided for the new notebook, matching repo conventions