A method, apparatus and medium for evaluating the security compliance of the MCP interaction protocol

Abstract

This invention relates to the field of artificial intelligence security assessment technology, and in particular to a method, apparatus, and medium for assessing the security compliance of the MCP (Multi-Channel Protocol) interaction protocol. The method includes: parsing the MCP protocol interaction traffic to obtain the parsing results; based on protocol metadata, associating tool call parameters and tool call result information to obtain the tool call chain corresponding to the large model agent; obtaining the context propagation path based on the tool call chain; obtaining risk assessment information based on the tool call chain and the context propagation path; and generating a security compliance assessment result corresponding to the MCP protocol interaction traffic based on the risk assessment information and preset compliance detection rules. This invention solves the problem that existing security detection methods struggle to identify associated risks during MCP protocol interaction.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security evaluation technology, and in particular to a method, apparatus and medium for evaluating the security compliance of the MCP interaction protocol. Background Technology

[0002] Existing security detection methods for large model agents mostly focus on input filtering, output content review, prompt word injection detection, interface security scanning, or log auditing. These methods typically target a single input, a single output, or a single interface, making it difficult to cover the parameter handling, result backfilling, and context passing processes that occur when large model agents make multiple tool calls.

[0003] In the MCP interaction protocol scenario, security risks may not originate from a single request or interface, but rather from the relationships between tool call parameters, context information, and tool call results. For example, the results of a preceding tool call may enter the context information and affect subsequent tool call parameters, and abnormal content may continue to propagate along the context propagation path. Existing detection methods struggle to construct tool call chains based on the protocol interaction process and to track the transmission of context information between different tool call nodes, leading to inaccurate identification of associated risks. Summary of the Invention

[0004] To address the problem that existing security testing methods struggle to identify associated risks during MCP protocol interactions, this invention provides a method, apparatus, and medium for evaluating the security compliance of the MCP interaction protocol.

[0005] The above-mentioned objective of this invention is achieved through the following technical solution:

[0006] A method for assessing the security compliance of the MCP interaction protocol, comprising:

[0007] Acquire the MCP protocol interaction traffic of large model agents during the execution tool invocation process;

[0008] The MCP protocol interaction traffic is parsed to obtain the protocol parsing result, which includes protocol metadata, tool call parameters, context information, and tool call result information.

[0009] Based on the protocol metadata, the tool call parameters and the tool call result information are associated to obtain the tool call chain corresponding to the large model agent;

[0010] Based on the tool call chain, the transmission process of the context information between different tool call nodes is traced to obtain the context propagation path;

[0011] Based on the tool call chain and the context propagation path, the associated risk between the tool call parameters, the context information and the tool call result information is assessed to obtain risk assessment information.

[0012] Based on the risk assessment information and preset compliance detection rules, a security compliance assessment result is generated for the MCP protocol interaction traffic.

[0013] By adopting the above technical solution, the MCP protocol interaction traffic of the large model agent during tool invocation can be obtained first. Then, the interaction traffic is parsed to extract protocol metadata, tool invocation parameters, context information, and tool invocation result information. This allows security compliance assessment to go beyond a single input, single output, or single interface level. It enables the establishment of invocation associations between tool invocation parameters and tool invocation result information based on protocol metadata, forming a tool invocation chain corresponding to the large model agent. The transmission process of context information between different tool invocation nodes is traced along the tool invocation chain, thereby clarifying the propagation path of context information. Based on this, the associated risks between tool invocation parameters, context information, and tool invocation result information can be assessed. This can identify abnormal risks arising from parameter reception, result backfilling, and context transmission during multiple tool invocations. Combined with preset compliance detection rules, security compliance assessment results are generated, thereby improving the accuracy of risk identification and the completeness of compliance assessment in the MCP protocol interaction process.

[0014] Preferably, the step of parsing the MCP protocol interaction traffic to obtain the protocol parsing result includes:

[0015] Extract multiple protocol interaction messages from the MCP protocol interaction traffic;

[0016] Each of the protocol interaction messages is identified by field recognition to obtain the message field set corresponding to each of the protocol interaction messages;

[0017] Based on the field reference relationships between the various message field sets, interaction phase marking is performed on each of the protocol interaction messages to obtain the interaction phase marking result;

[0018] Based on the interaction phase marking results, the field content in each of the message field sets is classified to obtain the protocol metadata, the tool call parameters, the context information, and the tool call result information;

[0019] The protocol metadata, the tool call parameters, the context information, and the tool call result information are structurally correlated to obtain the protocol parsing result.

[0020] By adopting the above technical solution, multiple protocol interaction messages can be extracted from the MCP protocol interaction traffic, and the fields of the protocol interaction messages can be identified to obtain message field sets. This allows the field content in the original interaction traffic to be separated and organized. Based on the field reference relationships between different message field sets, the protocol interaction messages are marked with interaction stages, which clarifies the stage position of each protocol interaction message in the tool invocation process. Then, based on the interaction stage marking results, the field content is classified, which can obtain protocol metadata, tool invocation parameters, context information, and tool invocation result information respectively. Finally, the above information is structured and associated to form a complete and clearly attributed protocol parsing result, thereby improving the accuracy of MCP protocol interaction traffic parsing and the reliability of subsequent tool invocation chain construction.

[0021] Preferably, the step of associating the tool invocation parameters and the tool invocation result information based on the protocol metadata to obtain the tool invocation chain corresponding to the large model agent includes:

[0022] Based on the protocol metadata, the tool call parameters and the tool call result information are interactively assigned to obtain multiple tool call nodes;

[0023] Based on the protocol metadata corresponding to each tool invocation node, the invocation sequence relationship between each tool invocation node is determined;

[0024] Based on the tool call parameters and tool call result information in each tool call node, identify the parameter inheritance relationship between each tool call node;

[0025] Based on the invocation sequence and parameter inheritance relationship, multiple tool invocation nodes are associated to obtain node association results.

[0026] Based on the node association results, multiple tool calling nodes are organized in a chain according to the calling process to obtain the tool calling chain corresponding to the large model agent.

[0027] By adopting the above technical solution, the order of calls between different tool calling nodes can be determined based on the protocol metadata corresponding to each tool calling node. This makes the execution order of multiple tool calling nodes in the tool calling process clearer. Furthermore, by identifying the parameter succession relationship based on the tool calling parameters and tool calling result information in each tool calling node, it is possible to determine whether the return result of the previous tool calling node is continued to be used by the subsequent tool calling node. Then, based on the order of calls and parameter succession relationships, multiple tool calling nodes are associated to obtain node association results. These results are then organized in a chain according to the calling process to form the tool calling chain corresponding to the large model agent. This avoids the problem of inaccurate association caused by simply recording the tool calling process in chronological order, and improves the completeness of the reconstruction of multiple tool calling processes and the accuracy of context tracking.

[0028] Preferably, the step of tracing the transmission process of the context information between different tool call nodes according to the tool call chain to obtain the context propagation path includes:

[0029] Based on the tool call chain, determine the node connection relationship between each tool call node;

[0030] Based on the node connection relationship, the context information corresponding to each tool calling node is identified to obtain the context source result.

[0031] Based on the context source result, the reference status of the context information among the tool calling nodes is marked to obtain the context reference marking result;

[0032] Based on the context reference tagging results, determine the transmission direction and range of the context information between different tool invocation nodes;

[0033] Based on the transmission direction and the transmission range, the transmission process of the context information in the tool call chain is represented by a path to obtain the context propagation path.

[0034] By adopting the above technical solution, the node connection relationship between each tool call node can be determined based on the tool call chain, so that the tracking of context information has a clear call order basis. Then, the source of the context information corresponding to each tool call node is identified according to the node connection relationship, which can determine whether the context information comes from the current tool call node or the previous tool call node. Furthermore, the transmission direction and transmission range of context information between different tool call nodes can be determined through the context reference mark result, which can clarify where the context information is generated from, where it is transmitted to, and which tool call nodes it covers. Finally, the transmission process of context information in the tool call chain is represented by path to obtain the context propagation path, thereby improving the traceability of the context transmission process and facilitating the accurate identification of associated risks caused by context connection, reference or continuation.

[0035] Preferably, the risk assessment of the association between the tool call parameters, the context information, and the tool call result information based on the tool call chain and the context propagation path, to obtain risk assessment information, includes:

[0036] Based on the tool call chain, determine the intra-node association between the tool call parameters and the tool call result information corresponding to each tool call node;

[0037] Based on the context propagation path, the inter-node transmission relationship of the context information between different tool invocation nodes is determined;

[0038] Based on the intra-node associations and inter-node transmission relationships, the tool call parameters, the context information, and the tool call result information are compared for consistency to obtain an association consistency result.

[0039] Based on the correlation consistency results, abnormal correlation locations between the tool call parameters, the context information, and the tool call result information are identified to obtain abnormal correlation location results;

[0040] Based on the abnormal association location results, the associated risks corresponding to the abnormal association locations are assessed to obtain the risk assessment information.

[0041] By adopting the above technical solution, the intra-node association between tool call parameters and tool call result information can be determined based on the tool call chain, and the inter-node transmission relationship of context information between different tool call nodes can be determined based on the context propagation path. This allows risk assessment to simultaneously cover the correspondence between parameters and results within a single tool call node, as well as the context transmission between different tool call nodes. Then, by comparing the association consistency based on the intra-node association and the inter-node transmission relationship, it is possible to determine whether the tool call parameters, context information, and tool call result information maintain a normal continuity relationship. This further identifies abnormal association locations and forms abnormal association location results, giving the associated risks a clear location and basis for judgment, thereby improving the accuracy and interpretability of risk assessment information.

[0042] Preferably, the step of assessing the association risk corresponding to the abnormal association location based on the abnormal association location result to obtain the risk assessment information includes:

[0043] Based on the anomaly correlation location results, determine the target tool call node and target context propagation segment corresponding to the anomaly correlation location;

[0044] Based on the target tool call node, extract the abnormal association content corresponding to the abnormal association location from the tool call parameters, the context information, and the tool call result information;

[0045] Based on the target context propagation segment, determine the propagation source and propagation destination of the abnormal associated content in the tool call chain;

[0046] Based on the propagation source and the propagation destination, the influence range of the abnormal associated content among the tool call parameters, the context information and the tool call result information is divided to obtain abnormal influence range information;

[0047] Based on the information on the scope of impact of the anomaly, the associated risk level of the location associated with the anomaly is assessed to obtain the risk assessment information.

[0048] By adopting the above technical solution, the target tool call node and target context propagation segment can be determined based on the abnormal association location results. This allows the abnormal association location to simultaneously correspond to the specific call node and context propagation segment. Then, abnormal association content can be extracted from the tool call parameters, context information, and tool call result information, which can clearly identify the specific content object that causes the association risk. Furthermore, based on the target context propagation segment, the propagation source and propagation destination of the abnormal association content in the tool call chain can be determined, which can reconstruct the transmission process of the abnormal association content. Based on the propagation source and propagation destination, the scope of impact information of the abnormality can be divided, making the affected objects and scope of the association risk clearer. Finally, a level assessment can be conducted based on the abnormality impact scope information, which can generate more accurate risk assessment information, thereby improving the pertinence of abnormal association risk judgment and the credibility of assessment results.

[0049] Preferably, generating the security compliance assessment result corresponding to the MCP protocol interaction traffic based on the risk assessment information and preset compliance detection rules includes:

[0050] The risk assessment information is categorized into assessment objects to obtain risk object categorization results;

[0051] Based on the risk object classification results, the target compliance detection rule corresponding to the risk assessment information is determined from the preset compliance detection rules;

[0052] Based on the target compliance detection rules, rule hit analysis is performed on the risk occurrence location, risk level and risk impact scope corresponding to the risk assessment information to obtain the rule hit result;

[0053] Based on the rule hit results, the compliance deviation information corresponding to the MCP protocol interaction traffic is determined;

[0054] Based on the compliance deviation information and the risk assessment information, a security compliance assessment result is generated for the MCP protocol interaction traffic.

[0055] By adopting the above technical solution, the risk assessment information can be first categorized into assessment objects to obtain risk object classification results, making the scope of objects corresponding to associated risks clearer. Then, based on the risk object classification results, target compliance detection rules are determined from the preset compliance detection rules, which can avoid the problem of inconsistent matching objects between compliance detection rules and risk assessment information. Furthermore, according to the target compliance detection rules, rule hit analysis is performed on the location of risk occurrence, risk level, and risk impact scope to determine whether the risk assessment information triggers the corresponding compliance judgment conditions. Based on the rule hit results, compliance deviation information is determined, so that security risks and compliance deviations are correlated. Finally, the compliance deviation information and risk assessment information are combined to generate security compliance assessment results, thereby improving the accuracy and interpretability of MCP protocol interaction traffic compliance assessment.

[0056] Preferably, generating the security compliance assessment result corresponding to the MCP protocol interaction traffic based on the compliance deviation information and the risk assessment information includes:

[0057] Based on the compliance deviation information, determine the deviation object and degree of deviation corresponding to the MCP protocol interaction traffic;

[0058] Based on the deviation object, extract the target risk assessment information corresponding to the deviation object from the risk assessment information;

[0059] Based on the degree of deviation, the risk level corresponding to the target risk assessment information is corrected to obtain the corrected risk level;

[0060] Based on the deviation object, the degree of deviation, and the corrected risk level, the evaluation conclusion information corresponding to the MCP protocol interaction traffic is generated;

[0061] Based on the evaluation results, the security and compliance status of the MCP protocol interaction traffic are correlated and represented to obtain the security and compliance evaluation results.

[0062] By adopting the above technical solution, the deviation object and degree of deviation corresponding to the MCP protocol interaction traffic can be determined based on the compliance deviation information, so that the compliance deviation can be mapped to a specific object and the magnitude of the deviation. Then, based on the deviation object, the target risk assessment information is extracted from the risk assessment information, which can establish a correspondence between compliance deviation and related risks. Furthermore, the risk level corresponding to the target risk assessment information is corrected according to the degree of deviation, so that the risk level can reflect both security risk and compliance deviation. Subsequently, assessment conclusion information is generated based on the deviation object, the degree of deviation, and the corrected risk level, and the security status and compliance status are associated and represented. Thus, the security compliance assessment results can simultaneously reflect the risk level, the deviation object, and the compliance status, improving the completeness and accuracy of the assessment results.

[0063] The second objective of this invention is achieved through the following technical solution:

[0064] An MCP (Multi-Channel Protocol) security compliance assessment device, comprising:

[0065] The traffic acquisition module is used to acquire the MCP protocol interaction traffic of large model agents during the execution tool invocation process;

[0066] The protocol parsing module is used to parse the MCP protocol interaction traffic and obtain the protocol parsing result, which includes protocol metadata, tool call parameters, context information and tool call result information.

[0067] The call chain construction module is used to associate the tool call parameters and the tool call result information with the protocol metadata to obtain the tool call chain corresponding to the large model agent;

[0068] The context tracking module is used to track the transmission process of the context information between different tool call nodes according to the tool call chain, and obtain the context propagation path;

[0069] The risk assessment module is used to assess the associated risks between the tool call parameters, the context information, and the tool call result information based on the tool call chain and the context propagation path, and to obtain risk assessment information.

[0070] The compliance assessment module is used to generate security compliance assessment results for the MCP protocol interaction traffic based on the risk assessment information and preset compliance detection rules.

[0071] By adopting the above technical solution, the MCP protocol interaction traffic of the large model agent during tool invocation can be obtained first. Then, the interaction traffic is parsed to extract protocol metadata, tool invocation parameters, context information, and tool invocation result information. This allows security compliance assessment to go beyond a single input, single output, or single interface level. It enables the establishment of invocation associations between tool invocation parameters and tool invocation result information based on protocol metadata, forming a tool invocation chain corresponding to the large model agent. The transmission process of context information between different tool invocation nodes is traced along the tool invocation chain, thereby clarifying the propagation path of context information. Based on this, the associated risks between tool invocation parameters, context information, and tool invocation result information can be assessed. This can identify abnormal risks arising from parameter reception, result backfilling, and context transmission during multiple tool invocations. Combined with preset compliance detection rules, security compliance assessment results are generated, thereby improving the accuracy of risk identification and the completeness of compliance assessment in the MCP protocol interaction process.

[0072] The above-mentioned objective three of the present invention is achieved through the following technical solution:

[0073] A computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned MCP interaction protocol security compliance assessment method.

[0074] In summary, the present invention has at least one of the following beneficial technical effects:

[0075] It can first acquire the MCP protocol interaction traffic of a large model agent during tool invocation, then perform protocol parsing on the interaction traffic to extract protocol metadata, tool invocation parameters, context information, and tool invocation result information. This allows security compliance assessment to go beyond a single input, single output, or single interface level. It can further establish the invocation association between tool invocation parameters and tool invocation result information based on protocol metadata, forming a tool invocation chain corresponding to the large model agent. It can also trace the transmission process of context information between different tool invocation nodes along the tool invocation chain, thereby clarifying the propagation path of context information. Based on this, it can assess the associated risks between tool invocation parameters, context information, and tool invocation result information. It can identify abnormal risks caused by parameter reception, result backfilling, and context transmission during multiple tool invocations. Combined with preset compliance detection rules, it generates security compliance assessment results, thereby improving the accuracy of risk identification and the completeness of compliance assessment in the MCP protocol interaction process. Attached Figure Description

[0076] Figure 1 This is a flowchart of a method for evaluating the security compliance of an MCP interaction protocol according to an embodiment of the present invention.

[0077] Figure 2 This is a principle block diagram of an MCP interaction protocol security compliance evaluation device according to an embodiment of the present invention. Detailed Implementation

[0078] The present invention will be further described in detail below with reference to the accompanying drawings.

[0079] In one embodiment, such as Figure 1 As shown, this invention discloses a method for evaluating the security compliance of the MCP interaction protocol, which specifically includes the following steps:

[0080] S10: Obtain the MCP protocol interaction traffic of the large model agent during the execution tool invocation process.

[0081] In this embodiment, a large model agent refers to an agent that can generate processing intentions based on input tasks and call external tools to complete corresponding operations during task execution. The tool calling process refers to the interactive process in which the large model agent initiates a call request to an external tool and receives the call result. The MCP protocol interaction traffic refers to the set of interactive data formed by the large model agent in accordance with the MCP interaction protocol during the tool calling process. The MCP protocol interaction traffic is used to record the interactive content of the large model agent during the tool calling process.

[0082] Specifically, when acquiring the MCP protocol interaction traffic of the large model agent during the tool invocation process, during the interaction process of the large model agent initiating the tool invocation request, transmitting the invocation content, and receiving the invocation result, the interaction data formed according to the MCP interaction protocol is collected, and the collected interaction data is summarized according to the interaction order corresponding to the tool invocation process to obtain the MCP protocol interaction traffic.

[0083] S20: Perform protocol parsing on the MCP protocol interaction traffic to obtain protocol parsing results, which include protocol metadata, tool call parameters, context information, and tool call result information.

[0084] In this embodiment, the protocol parsing result refers to the structured result formed after identifying, classifying, and organizing the interaction data in the MCP protocol interaction traffic; the protocol metadata refers to the basic descriptive information used to characterize the source, order, and attribution of the interaction data in the MCP protocol interaction traffic; the tool call parameters refer to the parameter content passed by the large model agent to the external tool during the tool call process; the context information refers to the interaction content used by the large model agent to maintain task continuity during the tool call process; and the tool call result information refers to the result content returned to the large model agent by the external tool after responding to the tool call parameters.

[0085] Specifically, when performing protocol parsing on the MCP protocol interaction traffic to obtain the protocol parsing result, the interaction data in the MCP protocol interaction traffic is read item by item. The corresponding field content is identified according to the expression format of the interaction data in the MCP protocol interaction traffic. Based on the role of the field content in the tool invocation process, the field content describing the interaction source, interaction order, and interaction attribution is included in the protocol metadata; the field content used to initiate the tool invocation is included in the tool invocation parameters; the field content used to maintain task continuity is included in the context information; and the field content used to indicate the result returned by the external tool is included in the tool invocation result information. The protocol metadata, the tool invocation parameters, the context information, and the tool invocation result information are then organized according to their corresponding relationships to obtain the protocol parsing result.

[0086] S30: Based on the protocol metadata, the tool call parameters and the tool call result information are associated to obtain the tool call chain corresponding to the large model agent.

[0087] In this embodiment, call association refers to the process of establishing a correspondence between the tool call parameters and the tool call result information in the same tool call process based on the interaction source, interaction order and interaction attribution represented by the protocol metadata. The tool call chain refers to a chain record formed by arranging multiple tool call processes according to the order of calls and the content succession relationship. The tool call chain is used to represent the continuous call relationship of the large model agent in the process of executing tool calls.

[0088] Specifically, based on the protocol metadata, when associating the tool call parameters and the tool call result information to obtain the tool call chain corresponding to the large model agent, firstly, according to the content in the protocol metadata used to characterize the interaction attribution, the tool call parameters and the tool call result information belonging to the same tool call process are divided into the same call unit. Then, according to the content in the protocol metadata used to characterize the interaction order, multiple call units are arranged sequentially. Finally, according to the content continuity relationship between the tool call result information and the tool call parameters in adjacent call units, multiple call units are connected to form the tool call chain corresponding to the large model agent.

[0089] S40: Based on the tool call chain, the transmission process of the context information between different tool call nodes is traced to obtain the context propagation path.

[0090] In this embodiment, a tool call node refers to a node in the tool call chain that corresponds to a single tool call process. The tool call node is used to characterize the correspondence between the tool call parameters and the tool call result information. The context propagation path refers to the path record formed by the context information in different tool call nodes according to the transmission order. The context propagation path is used to characterize the transmission process of the context information in the tool call chain.

[0091] Specifically, based on the tool call chain, the transmission process of the context information between different tool call nodes is traced to obtain the context propagation path. First, the arrangement order between multiple tool call nodes is determined according to the tool call chain. Then, the context information contained in each tool call node is identified to determine the source and destination content of the context information in the current tool call node. Based on the content succession relationship between adjacent tool call nodes, it is determined whether the context information is transmitted from the previous tool call node to the next tool call node. If there is a continuous transmission relationship of the context information, the corresponding multiple tool call nodes are connected according to the transmission order to obtain the context propagation path.

[0092] S50: Based on the tool call chain and the context propagation path, assess the associated risks between the tool call parameters, the context information and the tool call result information to obtain risk assessment information.

[0093] In this embodiment, the associated risk refers to the risk formed when the tool call parameters, the context information, and the tool call result information are abnormally associated in the tool call chain and the context propagation path. The risk assessment information refers to the assessment result formed after identifying, locating, and judging the level of the associated risk. The risk assessment information is used to characterize the risk situation corresponding to the MCP protocol interaction traffic.

[0094] Specifically, based on the tool call chain and the context propagation path, the associated risk between the tool call parameters, the context information, and the tool call result information is assessed. When obtaining risk assessment information, firstly, the correspondence between the tool call parameters and the tool call result information in the same tool call node is determined according to the tool call chain. Then, the transmission relationship of the context information between different tool call nodes is determined according to the context propagation path. Subsequently, the tool call parameters, the context information, and the tool call result information are compared and associated according to the correspondence and transmission relationship to determine whether there is an abnormal association between the tool call parameters, the context information, and the tool call result information that is inconsistent with the normal call process. If the abnormal association exists, the tool call node, context propagation position, and risk level corresponding to the abnormal association are determined to obtain the risk assessment information.

[0095] S60: Based on the risk assessment information and preset compliance detection rules, generate the security compliance assessment result corresponding to the MCP protocol interaction traffic.

[0096] In this embodiment, the preset compliance detection rule refers to the pre-set detection rule used to determine whether the risk assessment information meets the security compliance requirements. The security compliance assessment result refers to the result information generated based on the risk assessment information and the preset compliance detection rule. The security compliance assessment result is used to characterize the security status and compliance status corresponding to the MCP protocol interaction traffic.

[0097] Specifically, when generating the security compliance assessment result corresponding to the MCP protocol interaction traffic based on the risk assessment information and the preset compliance detection rules, the location and degree of associated risks in the MCP protocol interaction traffic are first determined based on the risk assessment information. Then, the location and degree of associated risks are compared with the detection conditions in the preset compliance detection rules to determine whether the associated risks meet the compliance requirements corresponding to the preset compliance detection rules. If the associated risks do not meet the compliance requirements, the compliance deviation corresponding to the MCP protocol interaction traffic is determined. Based on the compliance deviation and the risk assessment information, the security status and compliance status corresponding to the MCP protocol interaction traffic are sorted out to generate the security compliance assessment result.

[0098] In one embodiment, step S20, namely, performing protocol parsing on the MCP protocol interaction traffic to obtain the protocol parsing result, includes:

[0099] S201: Extract multiple protocol interaction messages from the MCP protocol interaction traffic.

[0100] In this embodiment, the protocol interaction message refers to a single interaction data unit formed according to the MCP interaction protocol in the MCP protocol interaction traffic. The protocol interaction message is used to carry the interaction content of the large model agent in the tool invocation process. Multiple protocol interaction messages are composed of the MCP protocol interaction traffic according to the interaction order in the tool invocation process.

[0101] Specifically, when extracting multiple protocol interaction messages from the MCP protocol interaction traffic, the interaction data in the MCP protocol interaction traffic is read, and the continuous interaction data is divided into multiple independent interaction data units according to the start and end positions and interaction boundaries of the interaction data in the MCP protocol interaction traffic. Each interaction data unit is determined as a protocol interaction message, and the multiple protocol interaction messages are arranged according to the order in which the protocol interaction messages appear in the MCP protocol interaction traffic to obtain multiple protocol interaction messages extracted from the MCP protocol interaction traffic.

[0102] S202: Perform field identification on each of the protocol interaction messages to obtain the message field set corresponding to each of the protocol interaction messages.

[0103] In this embodiment, field identification refers to the process of distinguishing different field contents carried in the protocol interaction message according to the content boundaries and expression relationships in the protocol interaction message. The message field set refers to the set composed of multiple field contents identified from a single protocol interaction message according to their corresponding relationships. The message field set is used to characterize the interaction content contained in the protocol interaction message.

[0104] Specifically, when performing field identification on each of the protocol interaction messages to obtain the message field set corresponding to each of the protocol interaction messages, the content of each of the protocol interaction messages is read one by one. According to the field separation relationship and field hierarchy relationship in the protocol interaction messages, the different field contents in the protocol interaction messages are divided into boundaries. Based on the positional relationship and inclusion relationship of each field content in the protocol interaction messages, the field contents belonging to the same protocol interaction message are grouped together to obtain the message field set corresponding to each of the protocol interaction messages.

[0105] S203: Based on the field reference relationship between the various message field sets, perform interaction stage marking on each of the protocol interaction messages to obtain the interaction stage marking result.

[0106] In this embodiment, the field reference relationship refers to the reference, succession, or correspondence relationship between the field contents of different message field sets. The interaction stage marking refers to the process of marking the stage position of each protocol interaction message in the tool invocation process according to the field reference relationship. The interaction stage marking result refers to the marking correspondence result between each protocol interaction message and the corresponding interaction stage. The interaction stage marking result is used to characterize the sequential stage of each protocol interaction message in the tool invocation process.

[0107] Specifically, based on the field reference relationships between the various message field sets, interaction stage marking is performed on each of the protocol interaction messages. When the interaction stage marking result is obtained, the field content in each of the message field sets is compared to determine whether there is field content reference, field content continuation, or field content correspondence between different message field sets. Stage associations are established for the protocol interaction messages that have field content references, field content continuations, or field content correspondences. According to the order of the stage associations in the tool invocation process, interaction stage marking is performed on each of the protocol interaction messages to obtain the interaction stage marking result.

[0108] S204: Based on the interaction phase marking results, classify the field content in each of the message field sets to obtain the protocol metadata, the tool call parameters, the context information, and the tool call result information.

[0109] In this embodiment, attribution classification refers to the process of classifying the field content in each message field set to a corresponding information category based on the interaction stage marking result and the role of the field content in the tool invocation process. The information category includes the protocol metadata, the tool invocation parameters, the context information, and the tool invocation result information.

[0110] Specifically, based on the interaction stage marking results, when classifying the field content in each of the message field sets to obtain the protocol metadata, the tool call parameters, the context information, and the tool call result information, firstly, the stage position of each protocol interaction message in the tool call process is determined based on the interaction stage marking results. Then, combining the correspondence between the field content in each of the message field sets and the stage position, the field content used to characterize the interaction source, interaction order, and interaction attribution is collected to obtain the protocol metadata. The field content used to initiate the tool call is collected to obtain the tool call parameters. The field content used to maintain task continuity is collected to obtain the context information. The field content used to represent the results returned by the external tool is collected to obtain the tool call result information.

[0111] S205: The protocol metadata, the tool call parameters, the context information, and the tool call result information are structurally correlated to obtain the protocol parsing result.

[0112] In this embodiment, structured association refers to the process of organizing and establishing associations for different information categories according to the correspondence between the protocol metadata, the tool call parameters, the context information, and the tool call result information during the tool call process.

[0113] Specifically, when obtaining the protocol parsing result by structurally associating the protocol metadata, tool call parameters, context information, and tool call result information, the corresponding positions of the tool call parameters, context information, and tool call result information in the tool call process are first determined based on the content in the protocol metadata that represents the interaction source, interaction order, and interaction attribution. Then, the tool call parameters, context information, and tool call result information with the same corresponding position or with a successor relationship are associated and organized. Finally, the organized protocol metadata, tool call parameters, context information, and tool call result information are arranged according to the interaction order in the tool call process to obtain the protocol parsing result.

[0114] In one embodiment, step S30, namely, based on the protocol metadata, performing call association on the tool call parameters and the tool call result information to obtain the tool call chain corresponding to the large model agent, includes:

[0115] S301: Based on the protocol metadata, the tool call parameters and the tool call result information are interactively assigned to obtain multiple tool call nodes.

[0116] In this embodiment, interaction attribution refers to the process of classifying the tool call parameters and tool call result information belonging to the same tool call process into the same attribution range based on the interaction source, interaction order and interaction attribution represented by the protocol metadata. The tool call node refers to the node formed by associating the tool call parameters and tool call result information in the same tool call process. The tool call node is used to represent the correspondence between parameter input and result return in a single tool call process.

[0117] Specifically, when multiple tool call nodes are obtained by classifying the interaction attribution of the tool call parameters and the tool call result information according to the protocol metadata, the content used to represent the interaction source, interaction order, and interaction attribution is first determined from the protocol metadata. Then, according to the interaction source, the interaction order, and the interaction attribution, the tool call parameters and the tool call result information are respectively assigned to the corresponding tool call process. The tool call parameters and tool call result information in the same tool call process are then organized to form a tool call node. The interaction attribution division is performed according to different tool call processes to obtain multiple tool call nodes.

[0118] S302: Based on the protocol metadata corresponding to each of the tool calling nodes, determine the order of calling among the tool calling nodes.

[0119] In this embodiment, the invocation sequence refers to the sequential relationship formed by multiple tool invocation nodes in the order of occurrence during the tool invocation process. The invocation sequence is used to characterize the order in which the large model agent executes multiple tool invocation nodes.

[0120] Specifically, when determining the order of calls between tool calling nodes based on the protocol metadata corresponding to each tool calling node, the content representing the interaction order in the protocol metadata corresponding to each tool calling node is read, and the tool calling nodes are arranged according to the interaction order. In the case where there is a sequential relationship between two tool calling nodes, the tool calling node that occurs first is determined as the preceding tool calling node, and the tool calling node that occurs later is determined as the following tool calling node. The order of calls between each tool calling node is determined according to the arrangement relationship between the multiple preceding tool calling nodes and the multiple following tool calling nodes.

[0121] S303: Identify the parameter connection relationship between each tool calling node based on the tool calling parameters and tool calling result information in each tool calling node.

[0122] In this embodiment, the parameter inheritance relationship refers to the correspondence formed when the tool call result information in the preceding tool call node is referenced, transferred, or continued to be used by the tool call parameters in the subsequent tool call node. The parameter inheritance relationship is used to characterize the data inheritance situation between different tool call nodes.

[0123] Specifically, when identifying the parameter succession relationship between tool calling nodes based on the tool calling parameters and tool calling result information in each tool calling node, the adjacent preceding and subsequent tool calling nodes are first determined according to the calling sequence. Then, the tool calling result information in the preceding tool calling node and the tool calling parameters in the subsequent tool calling node are read. The result content in the tool calling result information is compared with the parameter content in the tool calling parameters to determine whether the tool calling parameters in the subsequent tool calling node contain, reference, or continue to use the tool calling result information in the preceding tool calling node. If there is a relationship of inclusion, reference, or continued use, the preceding and subsequent tool calling nodes are determined to have the parameter succession relationship.

[0124] S304: Based on the order of invocation and the parameter succession relationship, perform node association on multiple tool invocation nodes to obtain node association results.

[0125] In this embodiment, node association refers to the process of establishing a corresponding relationship between the order of calls and the data connection between multiple tool calling nodes based on the order of calls and the parameter connection. The node association result refers to the association result formed after multiple tool calling nodes complete the node association. The node association result is used to characterize the sequential association and parameter association between multiple tool calling nodes.

[0126] Specifically, based on the invocation sequence and the parameter inheritance relationship, multiple tool invocation nodes are associated to obtain the node association result. First, the sequential arrangement of the multiple tool invocation nodes is determined according to the invocation sequence. Then, the inheritance relationship is determined according to the parameter inheritance relationship to determine whether there is an inheritance relationship between the tool invocation result information and the tool invocation parameter between the preceding and following tool invocation nodes. If two tool invocation nodes satisfy both the sequential arrangement and parameter inheritance relationship, a direct association is established between the two tool invocation nodes. If two tool invocation nodes only satisfy the sequential arrangement and do not have a parameter inheritance relationship, a sequential association is established between the two tool invocation nodes. The node association result is obtained by summarizing the direct and sequential associations between the multiple tool invocation nodes.

[0127] S305: Based on the node association results, organize the multiple tool calling nodes in a chain according to the calling process to obtain the tool calling chain corresponding to the large model agent.

[0128] In this embodiment, chain organization refers to the process of arranging and connecting multiple tool calling nodes according to the order and relationship in the calling process based on the node association results. The chain organization is used to form the tool calling chain that can represent the continuous calling relationship between multiple tool calling nodes.

[0129] Specifically, based on the node association results, when organizing multiple tool calling nodes in a chain according to the calling process to obtain the tool calling chain corresponding to the large model agent, firstly, the direct association and sequential association between each tool calling node are determined according to the node association results, then the arrangement position of multiple tool calling nodes is determined according to the order in the calling process, and the tool calling nodes with direct association are connected according to the parameter inheritance relationship, and the tool calling nodes with sequential association are connected according to the calling order relationship, and the connected multiple tool calling nodes are arranged continuously to obtain the tool calling chain corresponding to the large model agent.

[0130] In one embodiment, step S40, namely, tracing the transmission process of the context information between different tool call nodes according to the tool call chain to obtain the context propagation path, includes:

[0131] S401: Based on the tool call chain, determine the node connection relationship between each tool call node.

[0132] In this embodiment, the node succession relationship refers to the sequential connection relationship formed between different tool call nodes in the tool call chain according to the call process. The node succession relationship is used to characterize the continuous relationship between the previous tool call node and the next tool call node.

[0133] Specifically, when determining the node succession relationship between tool call nodes based on the tool call chain, the arrangement order of multiple tool call nodes in the tool call chain is first read. Then, according to the connection relationship of multiple tool call nodes in the tool call chain, the connection situation between adjacent tool call nodes is determined. The tool call node in the previous position is determined as the succession source node, and the tool call node in the next position is determined as the succession target node. The connection situation between the succession source node and the succession target node is determined as the node succession relationship.

[0134] S402: Based on the node connection relationship, identify the context source of the context information corresponding to each tool calling node to obtain the context source result.

[0135] In this embodiment, context source identification refers to the process of determining, based on the node succession relationship, that the context information corresponding to each tool call node originates from the current tool call node, the preceding tool call node, or other already accepted tool call nodes. The context source result refers to the result formed after identifying the source position of the context information corresponding to each tool call node. The context source result is used to characterize the source of the context information in the tool call chain.

[0136] Specifically, based on the node succession relationship, the context information corresponding to each tool call node is identified to obtain the context source result. First, the successor source node corresponding to the current tool call node is determined according to the node succession relationship. Then, the context information corresponding to the current tool call node is read, and the context information corresponding to the current tool call node is compared with the context information corresponding to the successor source node for content correspondence judgment. If there is a content continuity relationship between the context information corresponding to the current tool call node and the context information corresponding to the successor source node, the successor source node is determined as the source position of the context information corresponding to the current tool call node. If there is no content continuity relationship between the context information corresponding to the current tool call node and the context information corresponding to the successor source node, the current tool call node is determined as the source position of the context information. The context information corresponding to each tool call node is identified in the above manner to obtain the context source result.

[0137] S403: Based on the context source result, mark the reference status of the context information among the tool calling nodes to obtain the context reference marking result.

[0138] In this embodiment, the reference state refers to the state in which the context information is inherited, used, or continued by other tool calling nodes in one tool calling node. The context reference marking result refers to the result formed after marking whether the context information is referenced between the tool calling nodes and the reference position. The context reference marking result is used to characterize the reference status of the context information in the tool calling chain.

[0139] Specifically, based on the context source result, the reference status of the context information among the tool call nodes is marked to obtain the context reference marking result. First, the source position of the context information corresponding to each tool call node is determined according to the context source result. Then, according to the arrangement order of each tool call node in the tool call chain, the context information with the same source position or with content continuity relationship is searched accordingly. If the context information corresponding to the later tool call node inherits, uses, or continues the context information corresponding to the previous tool call node, the context information corresponding to the later tool call node is marked as referenced, and the previous tool call node that is referenced and the later tool call node that is referenced are recorded. If the context information is not inherited, used, or continued by other tool call nodes, the context information is marked as unreferenced. The reference status of the context information among the tool call nodes is marked item by item in the above manner to obtain the context reference marking result.

[0140] S404: Based on the context reference tag result, determine the transmission direction and transmission range of the context information between different tool calling nodes.

[0141] In this embodiment, the transmission direction refers to the transmission direction of the context information from the source position to the reference position between different tool call nodes, and the transmission range refers to the range of tool call nodes covered by the context information being received, used, or continued in the tool call chain. The transmission direction and the transmission range are used to characterize the transmission of the context information between different tool call nodes.

[0142] Specifically, when determining the transmission direction and range of the context information between different tool call nodes based on the context reference marking results, the referenced tool call node and the tool call node that is referenced are first read from the context reference marking results. The referenced tool call node is determined as the transmission start point, and the tool call node that is referenced is determined as the transmission end point. The transmission direction of the context information is determined according to the arrangement order between the transmission start point and the transmission end point in the tool call chain. Then, based on the reference status of the context information in multiple tool call nodes, the range of nodes covered by the context information from the transmission start point to the last referenced tool call node is determined, thus obtaining the transmission range of the context information between different tool call nodes.

[0143] S405: Based on the transmission direction and the transmission range, the transmission process of the context information in the tool call chain is represented by a path to obtain the context propagation path.

[0144] In this embodiment, path representation refers to the process of representing the transmission process of the context information in the tool call chain as a continuous path according to the transmission direction and the transmission range.

[0145] Specifically, based on the transmission direction and the transmission range, the transmission process of the context information in the tool call chain is represented by a path. When obtaining the context propagation path, the starting point and ending point of the transmission of the context information in the tool call chain are first determined according to the transmission direction. Then, the tool call nodes through which the context information passes are determined according to the transmission range. The tool call nodes are arranged in order according to the transmission direction. The transmission processes with reference states between adjacent tool call nodes are connected to form a continuous transmission path of the context information in the tool call chain. The continuous transmission path is determined as the context propagation path.

[0146] In one embodiment, in step S50, i.e., based on the tool call chain and the context propagation path, the association risk between the tool call parameters, the context information, and the tool call result information is assessed to obtain risk assessment information, including:

[0147] S501: Based on the tool call chain, determine the intra-node association between the tool call parameters and the tool call result information corresponding to each tool call node.

[0148] In this embodiment, the intra-node association refers to the correspondence between the tool call parameters and the tool call result information in the same tool call node. The intra-node association is used to characterize the association between the parameter input and the result return in a single tool call node.

[0149] Specifically, based on the tool call chain, when determining the intra-node association between the tool call parameters and the tool call result information corresponding to each tool call node, firstly, multiple tool call nodes and their arrangement positions in the tool call chain are determined according to the tool call chain. Then, the tool call parameters and the tool call result information in each tool call node are read respectively. Based on the input content of the tool call parameters in the corresponding tool call node and the return content of the tool call result information in the corresponding tool call node, it is determined whether the tool call result information and the tool call parameters have a content correspondence, result response, or status feedback relationship. If the content correspondence, result response, or status feedback relationship exists, an intra-node association is established between the tool call parameters and the tool call result information in the corresponding tool call node. The intra-node association judgment is performed on each tool call node in the above manner to obtain the intra-node association corresponding to each tool call node.

[0150] S502: Based on the context propagation path, determine the inter-node transmission relationship of the context information between different tool invocation nodes.

[0151] In this embodiment, the inter-node transmission relationship refers to the transmission correspondence formed between different tool calling nodes according to the context propagation path. The inter-node transmission relationship is used to characterize the situation where the context information is transmitted from one tool calling node to another tool calling node.

[0152] Specifically, when determining the inter-node transmission relationship of the context information between different tool calling nodes based on the context propagation path, the multiple tool calling nodes included in the context propagation path and the connection order between each tool calling node are first read. Then, according to the transmission start point, transmission end point and the tool calling nodes passed through in the context propagation path, the transmission correspondence of the context information between adjacent tool calling nodes is determined. If the context information in the previous tool calling node is received, used or continued by the next tool calling node, the previous tool calling node and the next tool calling node are determined to have an inter-node transmission relationship. The transmission correspondence judgment is performed on each adjacent tool calling node in the context propagation path in the above manner to obtain the inter-node transmission relationship of the context information between different tool calling nodes.

[0153] S503: Based on the intra-node association and inter-node transmission relationship, perform an association consistency comparison on the tool call parameters, the context information, and the tool call result information to obtain an association consistency result.

[0154] In this embodiment, the association consistency comparison refers to the process of determining whether the tool call parameters, the context information, and the tool call result information maintain corresponding consistency within the same tool call node and between different tool call nodes based on the intra-node association relationship and the inter-node transmission relationship. The association consistency result refers to the result formed after comparing the corresponding consistency between the tool call parameters, the context information, and the tool call result information. The association consistency result is used to characterize whether there is an abnormal association between the tool call parameters, the context information, and the tool call result information.

[0155] Specifically, based on the intra-node associations and inter-node transmission relationships, the tool call parameters, context information, and tool call result information are compared for consistency. To obtain a consistency result, first, the correspondence between the tool call parameters and tool call result information within the same tool call node is determined based on the intra-node associations. Then, the transmission of the context information between different tool call nodes is determined based on the inter-node transmission relationships. The tool call result information in the previous tool call node, the context information in the next tool call node, and the tool call parameters in the next tool call node are compared to determine whether the tool call result information maintains content continuity with the tool call parameters in the next tool call node after entering the context information. If content continuity is maintained, a consistent association result is generated. If content continuity is not maintained, an abnormal association result is generated. The consistent association result and the abnormal association result are then summarized into the consistency result.

[0156] S504: Based on the correlation consistency result, identify the abnormal correlation positions between the tool call parameters, the context information and the tool call result information, and obtain the abnormal correlation location result.

[0157] In this embodiment, the abnormal association location refers to the tool call node location or context propagation location when the tool call parameters, the context information, and the tool call result information do not maintain content continuity consistency. The abnormal association location result refers to the location result formed after identifying the abnormal association location. The abnormal association location result is used to characterize the position of the abnormal association in the tool call chain and the context propagation path.

[0158] Specifically, based on the association consistency result, when identifying abnormal association locations among the tool call parameters, the context information, and the tool call result information to obtain the abnormal association location result, the abnormal association result is first extracted from the association consistency result. Then, based on the tool call parameters, the context information, and the tool call result information corresponding to the abnormal association result, the tool call node where the abnormal association occurs is determined. The context propagation location corresponding to the abnormal association result is determined in conjunction with the context propagation path. The tool call node where the abnormal association occurs and the corresponding context propagation location are associated and recorded to obtain the abnormal association location result.

[0159] S505: Based on the abnormal association location result, assess the association risk corresponding to the abnormal association location to obtain the risk assessment information.

[0160] In this embodiment, the association risk assessment refers to the process of judging the degree of abnormal association and the impact of the abnormal association location based on the abnormal association location result. The association risk assessment is used to determine the risk situation corresponding to the abnormal association location.

[0161] Specifically, based on the abnormal association location results, the association risk corresponding to the abnormal association location is assessed. When obtaining the risk assessment information, firstly, the tool call node where the abnormal association occurs and the corresponding context propagation location are determined based on the abnormal association location results. Then, the tool call parameters, context information, and tool call result information corresponding to the abnormal association location are read. Based on the degree to which the content continuity between the tool call parameters, context information, and tool call result information is not maintained, the degree of abnormal association corresponding to the abnormal association location is determined. Subsequently, based on the position of the abnormal association location in the tool call chain and the propagation range in the context propagation path, the impact corresponding to the abnormal association location is determined. Based on the degree of abnormal association and the impact, the association risk corresponding to the abnormal association location is assessed to obtain the risk assessment information.

[0162] In one embodiment, step S505, namely, assessing the association risk corresponding to the abnormal association location based on the abnormal association location result to obtain the risk assessment information, includes:

[0163] S5051: Based on the anomaly association location result, determine the target tool call node and target context propagation segment corresponding to the anomaly association location.

[0164] In this embodiment, the target tool call node refers to the tool call node corresponding to the abnormal association position in the tool call chain. The target tool call node is used to characterize the specific call position where the abnormal association occurs. The target context propagation segment refers to the propagation segment corresponding to the abnormal association position in the context propagation path. The target context propagation segment is used to characterize the context propagation range corresponding to the abnormal association position.

[0165] Specifically, when determining the target tool call node and target context propagation segment corresponding to the abnormal association location based on the abnormal association location result, the tool call node location and context propagation location where the abnormal association occurs are first read from the abnormal association location result. The tool call node corresponding to the tool call node location where the abnormal association occurs is determined as the target tool call node. Then, based on the connection relationship between the context propagation location and the context propagation path, the context transmission start point and context transmission end point related to the abnormal association location are determined, and the propagation segment between the context transmission start point and the context transmission end point is determined as the target context propagation segment.

[0166] S5052: Based on the target tool call node, extract the abnormal association content corresponding to the abnormal association location from the tool call parameters, the context information, and the tool call result information.

[0167] In this embodiment, abnormal associated content refers to the content in the target tool call node that corresponds to the abnormal associated position and causes the tool call parameters, the context information, and the tool call result information to not maintain content continuity consistency. The abnormal associated content is used to characterize the specific content object corresponding to the abnormal associated position.

[0168] Specifically, when extracting the abnormal association content corresponding to the abnormal association position from the tool call parameters, the context information, and the tool call result information based on the target tool call node, the tool call parameters, the context information, and the tool call result information corresponding to the target tool call node are first determined. Then, according to the corresponding position of the abnormal association position in the target tool call node, the content in the tool call parameters, the context information, and the tool call result information that does not maintain consistent content continuity is located, and the located content is extracted to obtain the abnormal association content corresponding to the abnormal association position.

[0169] S5053: Based on the target context propagation segment, determine the propagation source and propagation destination of the abnormal associated content in the tool call chain.

[0170] In this embodiment, the propagation source refers to the starting transmission position of the abnormal associated content in the target context propagation segment. The propagation source is used to characterize the position where the abnormal associated content enters the tool call chain. The propagation destination refers to the subsequent transmission position of the abnormal associated content in the target context propagation segment. The propagation destination is used to characterize the direction of continued transmission of the abnormal associated content in the tool call chain.

[0171] Specifically, when determining the propagation source and propagation destination of the abnormal associated content in the tool call chain based on the target context propagation segment, firstly, the multiple tool call nodes contained in the target context propagation segment and the connection order between each tool call node are read. Then, the abnormal associated content is matched with the context information corresponding to each tool call node in the target context propagation segment to determine the tool call node where the abnormal associated content first appears. The tool call node where the abnormal associated content first appears is determined as the propagation source. Then, the subsequent tool call nodes containing the abnormal associated content are searched along the connection order of the target context propagation segment, and the propagation destination is determined by the transmission direction corresponding to the subsequent tool call nodes.

[0172] S5054: Based on the propagation source and the propagation destination, the influence range of the abnormal associated content among the tool call parameters, the context information and the tool call result information is divided to obtain abnormal influence range information.

[0173] In this embodiment, the scope of influence refers to the range of influence that the abnormal related content has on the tool call parameters, the context information, and the tool call result information during the process of the abnormal related content being transmitted from the source of propagation to the destination of propagation. The abnormal influence scope information refers to the information formed after dividing the scope of influence. The abnormal influence scope information is used to characterize the influence of the abnormal related content in the tool call chain.

[0174] Specifically, based on the propagation source and the propagation destination, the influence range of the abnormal associated content among the tool call parameters, the context information, and the tool call result information is divided to obtain the abnormal influence range information. First, the starting position of the abnormal associated content entering the tool call chain is determined according to the propagation source. Then, the subsequent transmission position of the abnormal associated content in the tool call chain is determined according to the propagation destination. Following the transmission order from the propagation source to the propagation destination, it is determined whether the abnormal associated content enters the tool call parameters, the context information, or the tool call result information of the corresponding tool call node. If the abnormal associated content enters the tool call parameters, the corresponding range is divided into parameter influence range. If the abnormal associated content enters the context information, the corresponding range is divided into context influence range. If the abnormal associated content enters the tool call result information, the corresponding range is divided into result influence range. The parameter influence range, the context influence range, and the result influence range are then summarized to obtain the abnormal influence range information.

[0175] S5055: Based on the information on the scope of impact of the anomaly, the associated risk level of the location associated with the anomaly is assessed to obtain the risk assessment information.

[0176] In this embodiment, the level assessment refers to the process of classifying and judging the degree of associated risk corresponding to the abnormal location based on the abnormal impact range information. The level assessment is used to determine the degree of risk corresponding to the abnormal location, and the risk assessment information refers to the information formed after the level assessment of the associated risk corresponding to the abnormal location.

[0177] Specifically, based on the anomaly impact range information, the associated risk level corresponding to the anomaly associated location is assessed. When obtaining the risk assessment information, the parameter impact range, context impact range, and result impact range contained in the anomaly impact range information are first read. Then, the degree of influence of the anomaly associated content on the tool call parameters is determined based on the parameter impact range, the degree of influence of the anomaly associated content on the context information is determined based on the context impact range, and the degree of influence of the anomaly associated content on the tool call result information is determined based on the result impact range. The degree of influence corresponding to the tool call parameters, the context information, and the tool call result information is comprehensively judged to determine the associated risk level corresponding to the anomaly associated location. The anomaly associated location, the anomaly impact range information, and the associated risk level are then organized to obtain the risk assessment information.

[0178] In one embodiment, step S60, namely generating the security compliance assessment result corresponding to the MCP protocol interaction traffic based on the risk assessment information and preset compliance detection rules, includes:

[0179] S601: Classify the risk assessment information into assessment objects to obtain risk object classification results.

[0180] In this embodiment, the classification of assessment objects refers to the process of determining the information object category corresponding to the risk assessment information based on the abnormal correlation location, abnormal impact range information and correlation risk level recorded in the risk assessment information. The risk object classification result refers to the result formed after classifying the assessment objects of the risk assessment information. The risk object classification result is used to characterize the scope of objects mainly corresponding to the correlation risk.

[0181] Specifically, when classifying the risk assessment information into assessment objects to obtain risk object classification results, the abnormal association location, the abnormal impact range information, and the associated risk level in the risk assessment information are first read. Then, based on the parameter impact range, context impact range, and result impact range involved in the abnormal impact range information, it is determined that the associated risk mainly affects the tool call parameters, the context information, or the tool call result information. Combined with the abnormal association location, the corresponding position of the associated risk in the tool call chain is determined. The objects affected by the associated risk in the tool call parameters, the context information, or the tool call result information are identified as risk objects and classified according to the information category corresponding to the risk objects to obtain the risk object classification results.

[0182] S602: Based on the risk object classification results, determine the target compliance detection rule corresponding to the risk assessment information from the preset compliance detection rules.

[0183] In this embodiment, the target compliance detection rule refers to the detection rule selected from the preset compliance detection rules that corresponds to the risk assessment information. The target compliance detection rule is used to make compliance judgments on the associated risks corresponding to the risk assessment information.

[0184] Specifically, when determining the target compliance detection rule corresponding to the risk assessment information from the preset compliance detection rules based on the risk object classification results, the risk object corresponding to the risk assessment information is first determined according to the risk object classification results. Then, the risk object is compared with the detection objects in the preset compliance detection rules. If the detection objects in the preset compliance detection rules correspond to the risk object, the corresponding preset compliance detection rule is determined as a candidate compliance detection rule. Then, based on the abnormal association location, abnormal impact range information, and associated risk level in the risk assessment information, the candidate compliance detection rule is adapted, and the candidate compliance detection rule adapted to the risk assessment information is determined as the target compliance detection rule.

[0185] S603: Based on the target compliance detection rules, perform rule hit analysis on the risk occurrence location, risk level, and risk impact scope corresponding to the risk assessment information to obtain the rule hit result.

[0186] In this embodiment, the risk occurrence location refers to the location in the tool call chain corresponding to the associated risk recorded in the risk assessment information; the risk level refers to the level judgment result corresponding to the associated risk recorded in the risk assessment information; the risk impact range refers to the range of influence of the associated risk recorded in the risk assessment information on the tool call parameters, the context information, and the tool call result information; rule hit analysis refers to the process of comparing the risk occurrence location, the risk level, and the risk impact range with the judgment conditions in the target compliance detection rule; and the rule hit result refers to the analysis result formed after determining whether the risk assessment information meets the judgment conditions in the target compliance detection rule.

[0187] Specifically, according to the target compliance detection rules, rule hit analysis is performed on the risk occurrence location, risk level, and risk impact range corresponding to the risk assessment information. When obtaining the rule hit result, the risk occurrence location, risk level, and risk impact range are first read from the risk assessment information. Then, the risk occurrence location is compared with the corresponding detection location condition in the target compliance detection rules, the risk level is compared with the corresponding level judgment condition in the target compliance detection rules, and the risk impact range is compared with the corresponding impact range condition in the target compliance detection rules. If at least one of the risk occurrence location, risk level, and risk impact range satisfies the judgment condition corresponding to the target compliance detection rules, the risk assessment information is determined to have hit the target compliance detection rules. If none of the risk occurrence location, risk level, and risk impact range satisfies the judgment condition corresponding to the target compliance detection rules, the risk assessment information is determined to have not hit the target compliance detection rules. The rule hit result is then generated based on the hit situation.

[0188] S604: Based on the rule hit result, determine the compliance deviation information corresponding to the MCP protocol interaction traffic.

[0189] In this embodiment, compliance deviation information refers to information determined based on the rule hit result, used to characterize whether the MCP protocol interaction traffic deviates from the target compliance detection rule. The compliance deviation information is used to record the content in the MCP protocol interaction traffic that does not meet compliance requirements and the degree of deviation.

[0190] Specifically, when determining the compliance deviation information corresponding to the MCP protocol interaction traffic based on the rule hit results, the hit status of the risk assessment information to the target compliance detection rule is first read from the rule hit results. If the rule hit results indicate that the risk assessment information hits the target compliance detection rule, it is determined that the associated risk corresponding to the risk assessment information has a compliance deviation from the target compliance detection rule. Then, based on the risk occurrence location, risk level, and risk impact range corresponding to the rule hit results, the deviation location, deviation degree, and deviation range corresponding to the compliance deviation information are determined. If the rule hit results indicate that the risk assessment information does not hit the target compliance detection rule, it is determined that the associated risk corresponding to the risk assessment information has not formed a compliance deviation. The deviation location, deviation degree, and deviation range are then organized according to the rule hit results to obtain the compliance deviation information corresponding to the MCP protocol interaction traffic.

[0191] S605: Based on the compliance deviation information and the risk assessment information, generate the security compliance assessment result corresponding to the MCP protocol interaction traffic.

[0192] In this embodiment, the security compliance assessment result refers to the result formed after sorting out the security status and compliance status of the MCP protocol interaction traffic based on the compliance deviation information and the risk assessment information. The security compliance assessment result is used to characterize the risk and compliance status of the MCP protocol interaction traffic during the tool invocation process.

[0193] Specifically, when generating the security compliance assessment result corresponding to the MCP protocol interaction traffic based on the compliance deviation information and the risk assessment information, the deviation position, deviation degree, and deviation range in the compliance deviation information are first read, and the risk occurrence position, risk level, and risk impact range in the risk assessment information are read. Then, the deviation position is matched with the risk occurrence position, the deviation degree is matched with the risk level, and the deviation range is matched with the risk impact range to determine the corresponding content in the MCP protocol interaction traffic that simultaneously contains associated risks and compliance deviations. Based on the corresponding content, the security status and compliance status of the MCP protocol interaction traffic are summarized and organized to generate the security compliance assessment result corresponding to the MCP protocol interaction traffic.

[0194] In one embodiment, step S605, namely generating the security compliance assessment result corresponding to the MCP protocol interaction traffic based on the compliance deviation information and the risk assessment information, includes:

[0195] S6051: Based on the compliance deviation information, determine the deviation object and degree of deviation corresponding to the MCP protocol interaction traffic.

[0196] In this embodiment, the deviation object refers to the object in the compliance deviation information that does not meet the compliance requirements. The deviation object is used to characterize the specific object range corresponding to the compliance deviation information. The deviation degree refers to the magnitude of the deviation of the deviation object in the compliance deviation information relative to the compliance requirements. The deviation degree is used to characterize the severity of the compliance deviation corresponding to the deviation object.

[0197] Specifically, when determining the deviation object and deviation degree corresponding to the MCP protocol interaction traffic based on the compliance deviation information, the deviation position, deviation range, and deviation degree records in the compliance deviation information are first read. Then, the corresponding position of the compliance deviation information in the MCP protocol interaction traffic is determined based on the deviation position. The tool call parameters, context information, or tool call result information involved in the compliance deviation information are determined based on the deviation range. Objects that do not meet the compliance requirements in the deviation range are identified as deviation objects. The deviation size corresponding to the deviation object is determined based on the deviation degree record. The deviation objects and the deviation size are then matched and organized to obtain the deviation object and deviation degree corresponding to the MCP protocol interaction traffic.

[0198] S6052: Based on the deviation object, extract the target risk assessment information corresponding to the deviation object from the risk assessment information.

[0199] In this embodiment, the target risk assessment information refers to the portion of the risk assessment information that corresponds to the deviation object. The target risk assessment information is used to characterize the associated risk situation corresponding to the deviation object.

[0200] Specifically, when extracting target risk assessment information corresponding to the deviation object from the risk assessment information, based on the deviation object, the object range corresponding to the deviation object is first read, and the risk occurrence location, risk level, and risk impact range corresponding to the object range are found from the risk assessment information. If the risk occurrence location is consistent with the location corresponding to the deviation object, or if the risk impact range covers the object range corresponding to the deviation object, the corresponding risk assessment information is determined as the risk assessment content corresponding to the deviation object, and the risk assessment content is extracted from the risk assessment information to obtain the target risk assessment information.

[0201] S6053: Based on the degree of deviation, the risk level corresponding to the target risk assessment information is corrected to obtain the corrected risk level.

[0202] In this embodiment, deviation correction refers to the process of adjusting the original risk level in the target risk assessment information according to the degree of deviation. The corrected risk level refers to the level result obtained after the deviation correction of the risk level corresponding to the target risk assessment information. The corrected risk level is used to characterize the degree of risk corresponding to the deviation object when there are both associated risks and compliance deviations.

[0203] Specifically, based on the degree of deviation, the risk level corresponding to the target risk assessment information is corrected to obtain the corrected risk level. First, the risk level corresponding to the target risk assessment information is read. Then, based on the degree of deviation, the magnitude of the deviation of the deviation object relative to the compliance requirements is determined. The magnitude of the deviation is matched with a preset deviation level range to obtain the deviation level. Based on the deviation level, the corresponding level correction range is determined. The risk level corresponding to the target risk assessment information is adjusted according to the level correction range, and the adjusted risk level is determined as the corrected risk level.

[0204] S6054: Based on the deviation object, the degree of deviation, and the corrected risk level, generate the evaluation conclusion information corresponding to the MCP protocol interaction traffic.

[0205] In this embodiment, the evaluation conclusion information refers to the information formed by summarizing the content in the MCP protocol interaction traffic that involves both compliance deviation and associated risks based on the deviation object, the degree of deviation, and the corrected risk level. The evaluation conclusion information is used to characterize the security compliance judgment result of the deviation object in the MCP protocol interaction traffic.

[0206] Specifically, when generating the evaluation conclusion information corresponding to the MCP protocol interaction traffic based on the deviation object, the degree of deviation, and the corrected risk level, the deviation object is first bound to the corresponding position in the MCP protocol interaction traffic to obtain the object position correspondence. Then, the degree of deviation is combined with the corrected risk level to obtain the conclusion judgment basis corresponding to the deviation object. Based on the object position correspondence and the conclusion judgment basis, the compliance deviation and risk level of the deviation object in the MCP protocol interaction traffic are sorted out to generate the evaluation conclusion information containing the deviation object, the degree of deviation, the corrected risk level, and the corresponding judgment content.

[0207] S6055: Based on the evaluation conclusion information, the security status and compliance status corresponding to the MCP protocol interaction traffic are correlated and represented to obtain the security compliance evaluation result.

[0208] In this embodiment, the security status refers to the associated risk status of the MCP protocol interaction traffic during the tool invocation process, the compliance status refers to the satisfaction status of the MCP protocol interaction traffic relative to the preset compliance detection rules, and the association representation refers to the process of jointly expressing the security status and the compliance status according to the correspondence in the evaluation conclusion information.

[0209] Specifically, based on the evaluation conclusion information, the security status and compliance status corresponding to the MCP protocol interaction traffic are associated and represented to obtain the security compliance evaluation result. First, the deviation object, the degree of deviation, and the corrected risk level are read from the evaluation conclusion information. The security status corresponding to the deviation object is determined based on the corrected risk level, and the compliance status corresponding to the deviation object is determined based on the degree of deviation. Then, the security status and compliance status corresponding to the same deviation object are bound together to form a status association item. According to the corresponding position of the deviation object in the MCP protocol interaction traffic, multiple status association items are arranged and organized to obtain the security compliance evaluation result that can simultaneously represent the security status and the compliance status.

[0210] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0211] In one embodiment, an MCP interaction protocol security compliance assessment device is provided, which corresponds one-to-one with the MCP interaction protocol security compliance assessment method described in the above embodiments. For example... Figure 2 As shown, the MCP interaction protocol security compliance assessment device includes a traffic acquisition module, a protocol parsing module, a call chain construction module, a context tracing module, a risk assessment module, and a compliance assessment module.

[0212] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0213] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for evaluating the security compliance of the MCP interaction protocol, characterized in that, The aforementioned method for assessing the security compliance of the MCP interaction protocol includes: Acquire the MCP protocol interaction traffic of large model agents during the execution tool invocation process; The MCP protocol interaction traffic is parsed to obtain the protocol parsing result, which includes protocol metadata, tool call parameters, context information, and tool call result information. Based on the protocol metadata, the tool call parameters and the tool call result information are associated to obtain the tool call chain corresponding to the large model agent; Based on the tool call chain, the transmission process of the context information between different tool call nodes is traced to obtain the context propagation path; Based on the tool call chain and the context propagation path, the associated risk between the tool call parameters, the context information and the tool call result information is assessed to obtain risk assessment information. Based on the risk assessment information and preset compliance detection rules, a security compliance assessment result is generated for the MCP protocol interaction traffic.

2. The method for evaluating the security compliance of the MCP interaction protocol according to claim 1, characterized in that, The process of parsing the MCP protocol interaction traffic to obtain the protocol parsing result includes: Extract multiple protocol interaction messages from the MCP protocol interaction traffic; Each of the protocol interaction messages is identified by field recognition to obtain the message field set corresponding to each of the protocol interaction messages; Based on the field reference relationships between the various message field sets, interaction phase marking is performed on each of the protocol interaction messages to obtain the interaction phase marking result; Based on the interaction phase marking results, the field content in each of the message field sets is classified to obtain the protocol metadata, the tool call parameters, the context information, and the tool call result information; The protocol metadata, the tool call parameters, the context information, and the tool call result information are structurally correlated to obtain the protocol parsing result.

3. The method for evaluating the security compliance of the MCP interaction protocol according to claim 1, characterized in that, The process of associating the tool invocation parameters and the tool invocation result information based on the protocol metadata to obtain the tool invocation chain corresponding to the large model agent includes: Based on the protocol metadata, the tool call parameters and the tool call result information are interactively assigned to obtain multiple tool call nodes; Based on the protocol metadata corresponding to each tool invocation node, the invocation sequence relationship between each tool invocation node is determined; Based on the tool call parameters and tool call result information in each tool call node, identify the parameter inheritance relationship between each tool call node; Based on the invocation sequence and parameter inheritance relationship, multiple tool invocation nodes are associated to obtain node association results. Based on the node association results, multiple tool calling nodes are organized in a chain according to the calling process to obtain the tool calling chain corresponding to the large model agent.

4. The method for evaluating the security compliance of the MCP interaction protocol according to claim 1, characterized in that, The step of tracing the transmission process of the context information between different tool call nodes according to the tool call chain to obtain the context propagation path includes: Based on the tool call chain, determine the node connection relationship between each tool call node; Based on the node connection relationship, the context information corresponding to each tool calling node is identified to obtain the context source result. Based on the context source result, the reference status of the context information among the tool calling nodes is marked to obtain the context reference marking result; Based on the context reference tagging results, determine the transmission direction and range of the context information between different tool invocation nodes; Based on the transmission direction and the transmission range, the transmission process of the context information in the tool call chain is represented by a path to obtain the context propagation path.

5. The method for evaluating the security compliance of the MCP interaction protocol according to claim 1, characterized in that, The risk assessment is performed on the association between the tool call parameters, the context information, and the tool call result information based on the tool call chain and the context propagation path, to obtain risk assessment information, including: Based on the tool call chain, determine the intra-node association between the tool call parameters and the tool call result information corresponding to each tool call node; Based on the context propagation path, the inter-node transmission relationship of the context information between different tool invocation nodes is determined; Based on the intra-node associations and inter-node transmission relationships, the tool call parameters, the context information, and the tool call result information are compared for consistency to obtain an association consistency result. Based on the correlation consistency results, abnormal correlation locations between the tool call parameters, the context information, and the tool call result information are identified to obtain abnormal correlation location results; Based on the abnormal association location results, the associated risks corresponding to the abnormal association locations are assessed to obtain the risk assessment information.

6. The method for evaluating the security compliance of the MCP interaction protocol according to claim 5, characterized in that, The step of assessing the association risk corresponding to the abnormal association location based on the abnormal association location result, and obtaining the risk assessment information, includes: Based on the anomaly correlation location results, determine the target tool call node and target context propagation segment corresponding to the anomaly correlation location; Based on the target tool call node, extract the abnormal association content corresponding to the abnormal association location from the tool call parameters, the context information, and the tool call result information; Based on the target context propagation segment, determine the propagation source and propagation destination of the abnormal associated content in the tool call chain; Based on the propagation source and the propagation destination, the influence range of the abnormal associated content among the tool call parameters, the context information and the tool call result information is divided to obtain abnormal influence range information; Based on the information on the scope of impact of the anomaly, the associated risk level of the location associated with the anomaly is assessed to obtain the risk assessment information.

7. The method for evaluating the security compliance of the MCP interaction protocol according to claim 1, characterized in that, The step of generating a security compliance assessment result corresponding to the MCP protocol interaction traffic based on the risk assessment information and preset compliance detection rules includes: The risk assessment information is categorized into assessment objects to obtain risk object categorization results; Based on the risk object classification results, the target compliance detection rule corresponding to the risk assessment information is determined from the preset compliance detection rules; Based on the target compliance detection rules, rule hit analysis is performed on the risk occurrence location, risk level and risk impact scope corresponding to the risk assessment information to obtain the rule hit result; Based on the rule hit results, the compliance deviation information corresponding to the MCP protocol interaction traffic is determined; Based on the compliance deviation information and the risk assessment information, a security compliance assessment result is generated for the MCP protocol interaction traffic.

8. The method for evaluating the security compliance of the MCP interaction protocol according to claim 7, characterized in that, The step of generating a security compliance assessment result corresponding to the MCP protocol interaction traffic based on the compliance deviation information and the risk assessment information includes: Based on the compliance deviation information, determine the deviation object and degree of deviation corresponding to the MCP protocol interaction traffic; Based on the deviation object, extract the target risk assessment information corresponding to the deviation object from the risk assessment information; Based on the degree of deviation, the risk level corresponding to the target risk assessment information is corrected to obtain the corrected risk level; Based on the deviation object, the degree of deviation, and the corrected risk level, the evaluation conclusion information corresponding to the MCP protocol interaction traffic is generated; Based on the evaluation results, the security and compliance status of the MCP protocol interaction traffic are correlated and represented to obtain the security and compliance evaluation results.

9. A device for evaluating the security compliance of the MCP interactive protocol, characterized in that, The MCP interaction protocol security compliance evaluation device includes: The traffic acquisition module is used to acquire the MCP protocol interaction traffic of large model agents during the execution tool invocation process; The protocol parsing module is used to parse the MCP protocol interaction traffic and obtain the protocol parsing result, which includes protocol metadata, tool call parameters, context information and tool call result information. The call chain construction module is used to associate the tool call parameters and the tool call result information with the protocol metadata to obtain the tool call chain corresponding to the large model agent; The context tracking module is used to track the transmission process of the context information between different tool call nodes according to the tool call chain, and obtain the context propagation path; The risk assessment module is used to assess the associated risks between the tool call parameters, the context information, and the tool call result information based on the tool call chain and the context propagation path, and to obtain risk assessment information. The compliance assessment module is used to generate security compliance assessment results for the MCP protocol interaction traffic based on the risk assessment information and preset compliance detection rules.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the MCP interaction protocol security compliance evaluation method as described in any one of claims 1 to 8.

Images