Method and system for detecting risk of skill invocation of agent based on mcp protocol

Abstract

The embodiment of the specification discloses an agent skill calling risk detection method and system based on an MCP protocol. The method comprises the following steps: acquiring a JSON-RPC request message, extracting calling information, and generating structured calling record data according to the calling information; based on a multi-dimensional security risk detection engine, behavior deviation degree analysis, injection attack feature detection, tool calling legality verification and context consistency verification are performed on the structured calling record data; multi-dimensional risk assessment data is fused; the risk level of the skill calling corresponding to the structured calling record data is determined according to the comprehensive risk assessment data, and the defense strategy corresponding to the risk level is executed. The embodiment of the specification realizes multi-dimensional risk detection and active defense of agent skill calling under the MCP protocol, and meets the security requirements of high detection rate, low false alarm rate and real-time active defense of the agent runtime.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence security technology, specifically to a method and system for detecting the risk of intelligent agent skill invocation based on the MCP protocol. Background Technology

[0002] With the rapid development of large language model technology, intelligent agents based on large language models have been widely used in scenarios such as intelligent question answering, code generation, data analysis, and automated office work. To overcome the limitations of the large language model's own capabilities and enable intelligent agents to interact with the external world, the Model Context Protocol (MCP) was developed. The MCP protocol provides a unified connection method between large language model applications and external data sources and tools through a standardized JSON-RPC interface, enabling intelligent agents to call external tools to perform specific operations, such as database queries, file read / write, and API calls. However, existing security protection schemes for agent skill invocation under the MCP protocol have several technical problems. For example, skill invocation schemes relying on static rule matching can be bypassed by attackers through semantic perturbation, making it difficult to effectively identify indirect prompt injection and tool poisoning attacks. Schemes primarily based on detection, alerting, and post-event auditing suffer from a time lag between the discovery and handling of security risks, during which malicious skill invocations may have already been executed and caused substantial damage, lacking real-time blocking capabilities before execution. Schemes that isolate the judgment of a single skill invocation do not comprehensively consider the correlation between multi-turn dialogue context, agent historical behavior sequences, and tool invocation patterns, resulting in a high false positive rate. Furthermore, many schemes require modification of the internal code of the MCP server or client to embed security capabilities, lacking universal adaptability to various MCP components deployed in production environments, leading to high implementation costs and difficulties in promotion. Therefore, there is an urgent need for a method and system capable of multi-dimensional security risk detection and proactive defense for agent skill invocation under the MCP protocol. Summary of the Invention

[0003] This specification provides an embodiment of a method and system for detecting the risk of intelligent agent skill invocation based on the MCP protocol. The technical solution is as follows:

[0004] Firstly, embodiments of this specification provide a method for detecting risks associated with intelligent agent skill invocation based on the MCP protocol, comprising: acquiring JSON-RPC request messages generated when the MCP client invokes an intelligent agent skill, based on a security proxy gateway deployed on the communication link between the MCP client and the MCP server; extracting invocation information from the JSON-RPC request messages and generating structured invocation record data based on the invocation information; performing behavioral deviation analysis, injection attack feature detection, tool invocation legality verification, and context consistency verification on the structured invocation record data based on a multi-dimensional security risk detection engine to obtain multi-dimensional risk assessment data; fusing the multi-dimensional risk assessment data to obtain comprehensive risk assessment data; determining the risk level of the skill invocation corresponding to the structured invocation record data based on the comprehensive risk assessment data, and executing a defense strategy corresponding to the risk level to obtain a defense decision result.

[0005] Secondly, this specification provides an intelligent agent skill invocation risk detection system based on the MCP protocol, comprising: a message acquisition module, used to acquire JSON-RPC request messages generated when the MCP client invokes an intelligent agent skill based on a security proxy gateway deployed on the communication link between the MCP client and the MCP server; an information extraction module, used to extract invocation information from the JSON-RPC request messages and generate structured invocation record data based on the invocation information; an analysis and evaluation module, used to perform behavioral deviation analysis, injection attack feature detection, tool invocation legality verification, and context consistency verification on the structured invocation record data based on a multi-dimensional security risk detection engine, to obtain multi-dimensional risk assessment data; a data fusion module, used to fuse the multi-dimensional risk assessment data to obtain comprehensive risk assessment data; and a risk defense module, used to determine the risk level of the skill invocation corresponding to the structured invocation record data based on the comprehensive risk assessment data, and execute the defense strategy corresponding to the risk level to obtain the defense decision result.

[0006] The beneficial effects of the technical solutions provided in some embodiments of this specification include at least the following:

[0007] This embodiment demonstrates how to deploy a security proxy gateway on the communication link between the MCP client and the server to obtain the JSON-RPC request messages generated when the MCP client invokes an agent's skills. The security proxy gateway can operate in transparent proxy mode, achieving secure detection and defense of skill invocations without modifying any MCP component code or configuration. Compared to existing solutions that require intrusive code modifications to embed security capabilities, this embodiment offers strong versatility and low deployment costs, seamlessly integrating with various already deployed MCP components.

[0008] Furthermore, the embodiments in this specification can conduct a comprehensive risk assessment of skill invocation from dimensions such as behavioral deviation, injection attack characteristics, tool invocation legality, and contextual consistency. Multiple dimensions complement and cross-validate each other, effectively covering various attack types such as indirect prompt injection, tool poisoning, and command injection, significantly improving the attack detection rate.

[0009] Furthermore, the embodiments in this specification can determine the risk level of skill invocation based on comprehensive risk assessment data and execute defense strategies corresponding to the risk level, thereby automatically implementing tiered defense before skill invocation is executed. Unlike existing solutions that rely solely on a passive response mode of detection, alarms, and post-event auditing, the embodiments in this specification achieve real-time proactive defense before invocation execution, eliminating potential threats without interrupting the skill invocation process and achieving a dynamic balance between security and availability. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram illustrating the application scenario of the intelligent agent skill call risk detection system based on the MCP protocol provided in this manual.

[0012] Figure 2 This is a flowchart illustrating the risk detection method for intelligent agent skill invocation based on the MCP protocol provided in this manual.

[0013] Figure 3 This is a flowchart illustrating the behavioral deviation analysis process provided in this manual.

[0014] Figure 4 This is a schematic diagram of the process for detecting injection attack features provided in this invention.

[0015] Figure 5 This is a flowchart illustrating the execution of defense strategies corresponding to risk levels, as provided in this manual.

[0016] Figure 6 This is a schematic diagram of the intelligent agent skill call risk detection system based on the MCP protocol provided in this manual.

[0017] Figure 7 This is a schematic diagram of the electronic device provided in this manual. Detailed Implementation

[0018] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings.

[0019] The terms "first," "second," etc., in the description, claims, and accompanying drawings are used to distinguish different objects and not to describe a particular order. Furthermore, the term "comprising" and any variations thereof are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0020] This specification provides a method for detecting the risk of intelligent agent skill invocation based on the MCP protocol through several embodiments. The executing entity of this method can be an intelligent agent skill invocation risk detection system based on the MCP protocol provided in this embodiment of the invention.

[0021] Before this specification elaborates on the method for detecting the risk of intelligent agent skill invocation based on the MCP protocol in conjunction with one or more embodiments, it first introduces the application scenarios of this method.

[0022] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating an application scenario of an agent skill call risk detection method based on the MCP protocol provided in an embodiment of the present invention. In this embodiment, an agent skill call risk detection system 100 based on the MCP protocol can be integrated into an electronic device, such as a terminal or a server. The terminal can be a mobile phone, tablet computer, laptop computer, or personal computer (PC); the server can be a single server or a server cluster composed of multiple servers.

[0023] In some embodiments, the MCP protocol-based agent skill invocation risk detection system 100 may further include a security proxy gateway 110, an MCP client 120, an MCP server 130, a local server 140, and a storage terminal 150. The security proxy gateway 110 is deployed on the communication link between the MCP client 120 and the MCP server 130, and is used to intercept JSON-RPC request messages generated when the MCP client 120 invokes agent skills, and mirror the intercepted JSON-RPC request messages to the multi-dimensional security risk detection engine 140. The MCP client 120 is an agent application based on a large language model, used to initiate skill invocation requests to the MCP server 130. The MCP server 130 is used to provide external tools or skills that can be invoked. The local server 140 deploys the multi-dimensional security risk detection engine, which is used to perform security risk detection on the JSON-RPC request messages and generate defense decision results.

[0024] In some embodiments, the agent skill call risk detection system 100 based on the MCP protocol can be integrated into multiple electronic devices. For example, the risk detection system 100 can be integrated into multiple servers, and multiple servers can implement the agent skill call risk detection method based on the MCP protocol of this application.

[0025] In some embodiments, the server may also be implemented as a terminal. The terminal may be a device such as a mobile phone, tablet, laptop, or personal computer (PC). The terminal includes a central processing unit (CPU), a graphics processing unit (GPU), memory, storage devices, a network communication module, sensors, a display screen, a battery and power management module, etc.

[0026] For example, refer to Figure 1 The local server 140 can connect to the security proxy gateway 110 and the storage terminal 150. The storage terminal 150 can store structured call record data, audit logs, labeled sample sets, etc., which will not be described in detail here.

[0027] The local server 150 may include a processor and memory. Based on the JSON-RPC request messages intercepted by the security proxy gateway 110, the local server 150 extracts call information and generates structured call record data; it then calls a multi-dimensional security risk detection engine to perform behavioral deviation analysis, injection attack feature detection, tool call legality verification, and context consistency verification on the structured call record data to obtain multi-dimensional risk assessment data; it fuses the multi-dimensional risk assessment data to obtain comprehensive risk assessment data; it determines the risk level based on the comprehensive risk assessment data and executes the corresponding defense strategy to obtain the defense decision result; and it feeds the defense decision result back to the multi-dimensional security risk detection engine for online incremental updates.

[0028] It should be noted that, Figure 1 The illustrated application scenario diagram of the intelligent agent skill call risk detection system based on the MCP protocol is merely an example. The intelligent agent skill call risk detection system and scenario described in this embodiment of the invention are for the purpose of more clearly illustrating the technical solutions of this embodiment of the invention, and do not constitute a limitation on the technical solutions provided by this embodiment of the invention. As those skilled in the art will know, with the evolution of the intelligent agent skill call risk detection system based on the MCP protocol and the emergence of new scenarios, the technical solutions provided by this embodiment of the invention are also applicable to similar technical problems.

[0029] Please see Figure 2 , Figure 2 This is a flowchart illustrating a method for detecting the risk of intelligent agent skill invocation based on the MCP protocol, provided in an embodiment of the present invention. This method for detecting the risk of intelligent agent skill invocation based on the MCP protocol can be... Figure 1 The illustrated agent skill invocation risk detection system 100 based on the MCP protocol is executed. This agent skill invocation risk detection method based on the MCP protocol includes:

[0030] 200. Based on the security proxy gateway deployed on the communication link between the MCP client and the MCP server, obtain the JSON-RPC request message generated when the MCP client calls the intelligent agent skill;

[0031] 210. Extract call information from JSON-RPC request messages and generate structured call record data based on the call information;

[0032] 220. Based on a multi-dimensional security risk detection engine, behavioral deviation analysis, injection attack feature detection, tool call legality verification, and context consistency verification are performed on structured call record data to obtain multi-dimensional risk assessment data.

[0033] 230. The multidimensional risk assessment data is fused and processed to obtain comprehensive risk assessment data;

[0034] 240. Determine the risk level of skill calls corresponding to the structured call record data based on the comprehensive risk assessment data, and execute the defense strategy corresponding to the risk level to obtain the defense decision result.

[0035] In this embodiment, the JSON-RPC request message is a Remote Procedure Call Protocol (RPC) data packet, encapsulating communication content in JSON format. It is used to initiate method calls and pass parameters between the MCP client and the MCP server. The multi-dimensional security risk detection engine in this embodiment is a security detection component deployed on a local server. It performs multi-dimensional security risk detection on the JSON-RPC request messages generated when the MCP client invokes intelligent agent skills. This engine takes structured call record data as input and performs behavioral deviation analysis, injection attack feature detection, tool call legality verification, and context consistency verification, outputting multi-dimensional risk assessment data. It also achieves online incremental updates of the model and rule base through a feedback loop.

[0036] In this embodiment, a security proxy gateway can be deployed on the communication link between the MCP client and the MCP server. The security proxy gateway operates in transparent proxy mode, intercepting all passing JSON-RPC request messages without requiring any modification to the client or server configuration. This embodiment can extract information such as the request method name (e.g., tools / call, tools / list), tool name, skill name, call parameter list, session identifier, client identifier, and associated context history sequence from the intercepted JSON-RPC request messages, constructing structured call record data.

[0037] The session identifier is used to associate multiple skill calls within the same session window, forming a session-level behavior sequence, i.e., a historical skill call sequence, which provides a data foundation for subsequent processes such as behavior deviation analysis and context consistency verification.

[0038] In some embodiments, please refer to Figure 3 , Figure 3 This is a flowchart illustrating the behavioral deviation analysis provided in an embodiment of the present invention. Based on a multi-dimensional security risk detection engine, behavioral deviation analysis is performed on structured call record data, including:

[0039] 300. Based on the session identifier in the structured call record data, extract the historical skill call sequence within the current session window corresponding to the session identifier;

[0040] 310. Convert each skill call record in the historical skill call sequence into a structured feature vector to obtain a structured feature vector sequence. The structured feature vector includes at least one or more of the following: tool name feature, call parameter statistics feature, time feature, and call result status feature.

[0041] 320. Input the structured feature vector sequence into the pre-trained behavior prediction model to predict the probability distribution of the next skill invocation;

[0042] 330. Obtain the currently invoked tool, determine its percentile rank and relative probability deviation in the probability distribution;

[0043] 340. Determine the behavioral deviation risk score data based on the ranking percentile and relative probability deviation.

[0044] In this embodiment, the historical skill call sequence is the chronological arrangement of skill call records within the current session window. The behavior prediction model includes a sequence encoder and a classification head. The sequence encoder encodes the structured feature vector sequence to obtain a session state vector, and the classification head predicts the probability distribution of the next skill call based on the session state vector.

[0045] In this embodiment, behavioral deviation analysis is used to determine whether the current skill call is an abnormal behavior given a session context. Its calculation process mainly includes steps such as session state encoding, probability distribution prediction, and deviation quantification scoring.

[0046] In this embodiment, the session state encoding can set the historical skill call sequence of the agent within the current session window as S=[s1,s2,...,s...]. i ], where s i The structured feature vector representing the i-th skill call is an embedding representation containing the following fields: one-hot encoded or learned embedding vector of the tool name, statistical features of the call parameters (number of parameters, parameter type distribution, parameter value length, etc.), time features of the call timestamp (time interval from the start of the session, time interval from the previous call), and status features of the call result (success / failure / abnormality), etc. In this embodiment, the historical skill call sequence S can also be input into the sequence encoder of the behavior prediction model to obtain the vector representation h=SequenceEncoder[s1,s2,...,s] of the current session state. i ] Here, SequenceEncoder is a Transformer encoder based on a multi-head self-attention mechanism, and the output h can be a dense vector of fixed dimensions (such as 256 dimensions).

[0047] To determine whether the current skill call conforms to the historical behavior pattern, the system in this embodiment may further input the session state vector h into the classification head to predict the probability distribution of the next skill call. Specifically, the classification head performs linear transformation on the session state vector, and then performs normalization processing through a softmax function to obtain a probability vector P with a dimension of M. Wherein, M is the total number of all callable tools or skills, and the j-th element P[j] of P represents the probability that the agent calls the tool j in the next step. The calculation process can be expressed as: P = softmax(W·h+b), where W is the weight matrix, and b is the bias vector.

[0048] In step 330 of this embodiment, the currently actually called tool c may be acquired, and the rank percentile thereof in the predicted probability distribution P is calculated as: rank_percentile=|{j:P[j]>P[c]}| / M. This value represents the proportion of tools that are more reasonable than the actually called tool c in the current session state. A rank percentile close to 0 indicates that the current call is more consistent with the behavior expectation; a rank percentile close to 1 indicates that the current call deviates more from the normal behavior pattern.

[0049] The calculation formula for the behavior deviation risk score R1 in this embodiment is: R1=1-P[c] / P_max, where P_max = max(P[1], P[2], ..., P[M]), that is, the maximum probability value in the predicted probability distribution. The calculation formula for the behavior deviation risk score R1 is used to compare the ratio of the probability of the actually called tool to the predicted probability of the optimally selected tool. When the actually called tool is the tool with the highest predicted probability, R1 approaches 0; when the predicted probability of the actually called tool is much lower than the optimal selection, R1 approaches 1.

[0050] In this embodiment, the system may further set a probability distribution threshold determination supplementary mechanism: in addition to the calculation of the rank percentile and the probability ratio, an absolute probability threshold T_prob may be directly set. When P[c]<T_prob (for example, T_prob=0.05), R1 is directly set to a high value (such as 0.9), so as to cope with the situation where the probability distribution is relatively uniform but the absolute value of the probability of the actually called tool is extremely low.

[0051] In some embodiments, the sequence encoder of the behavior prediction model is a Transformer encoder based on a multi-head self-attention mechanism, and the classification head includes a fully connected layer and a softmax function layer; the behavior prediction model is trained in a supervised learning manner, the training samples take the historical skill call sequence as input features, and the supervision label is the name of the tool actually called next in the historical skill call sequence.

[0052] In this embodiment, the behavior prediction model can adopt a two-stage architecture of a Transformer encoder and a classification head. The input layer receives the historical skill call sequence S. The structured feature vector of the i-th skill call is a multi-dimensional feature vector, which can be mapped to a 256-dimensional model space through linear projection. The position encoding layer in the architecture can use learnable position encoding to add positional information to each position in the sequence. The Transformer encoder in the architecture can contain four Transformer blocks, each containing a multi-head self-attention mechanism (e.g., eight heads) and a feedforward neural network. The self-attention mechanism enables the model to capture the dependencies between any two positions in the historical call sequence, thereby learning long-range behavioral patterns of tool calls. The pooling layer in the architecture can perform average pooling on the sequence representation output by the encoder to obtain a fixed-length session state vector h (e.g., 256 dimensions). The classification head in the architecture can be a fully connected layer, mapping h to an M-dimensional output (M being the total number of callable tools / skills), and outputting a probability distribution P after softmax normalization.

[0053] The training data for the behavior prediction model in this embodiment can be collected from the audit logs of the MCP server under normal task scenarios, including complete skill call sequences. The input for each training sample is: the sequence of the first N skill calls in the session (N ranges from 5 to 20, and the specific value can be set according to the average session length); the label for each training sample is: the name of the tool actually called in the (N+1)th session. To ensure data quality, only sessions with a successful task completion status can be selected, excluding abnormal sessions such as those with interruptions or errors. The training set size can be no less than 10,000 sessions, and multiple training samples can be extracted from different window positions for each session. The training method for the behavior prediction model in this embodiment can adopt a standard supervised learning paradigm, with the loss function being cross-entropy loss: L = -Σ i y i ·log(P i ), where y i For one-hot encoding of the actual calling tool, P i The model predicts the probability distribution. In this embodiment, the AdamW optimizer can be used for training, with an initial learning rate of 1e-4, a batch size of 64, and 50 training epochs. An early stopping strategy can be employed on the validation set, stopping training when the validation loss does not decrease for five consecutive epochs. To prevent overfitting, the system can apply Dropout regularization of 0.1 and weight decay of 1e-5 to the model parameters.

[0054] The behavior prediction model deployed in this embodiment supports online incremental updates. When manual review confirms that a defense decision has been misjudged, the sequence data of that call and the correct label are used as incremental training samples. The model is updated step by step or in a small number of steps with a small learning rate (e.g., 1e-5), so that the model gradually adapts to the changes in the tool calling mode of the current environment.

[0055] In some embodiments, please refer to Figure 4 , Figure 4 This is a schematic diagram of the process for detecting injection attack features provided in an embodiment of the present invention. Based on a multi-dimensional security risk detection engine, injection attack feature detection is performed on structured call record data, including:

[0056] 400. Retrieve text parameters from structured call log data;

[0057] 410. Perform semantic perturbation on text-type parameters to generate several semantically equivalent variants;

[0058] 420. Input the textual parameters and several semantically equivalent variants into the semantic similarity model to obtain several output vectors;

[0059] 430. Calculate the KL divergence between the output vector corresponding to the textual parameter and the output vector corresponding to several semantically equivalent variants, and generate injection risk score data based on the maximum KL divergence value.

[0060] In this embodiment, the semantic perturbation operator can include at least synonym substitution, sentence transformation, and character-level perturbation. This embodiment can perform multimodal detection of injection attack features on structured call record data, that is, perform adversarial robustness detection on the parameter content of skill calls. This can include applying semantic perturbation operators (such as synonym substitution, sentence transformation, and character-level perturbation) to textual parameters to generate K semantically equivalent variants; inputting the original parameters and the K variants into a semantic similarity model to obtain output vectors; calculating the maximum KL divergence value between the original parameter output vector and the K variant output vectors. If the maximum KL divergence value exceeds a preset threshold T2, it is determined that there are adversarial injection features in the parameters, and an injection risk score R2 is generated.

[0061] In some embodiments, a multi-dimensional security risk detection engine is used to perform tool call legality verification on structured call record data, including: obtaining the current call parameters and the supported parameter patterns of the target tool based on the structured call record data; parsing the supported parameter patterns to generate a parameter pattern set; if the current call parameters do not match any pattern in the parameter pattern set, or if the current call parameters contain command injection features, it is determined that there is a tool call anomaly, and legality risk score data is generated; the current call parameters include the parameter name and parameter value of the current skill call; the command injection features include at least one or more of the following: system command keywords, pipe characters, backticks, and command substitution syntax.

[0062] This embodiment can perform tool call legality verification, including: parsing the support parameter patterns of the target tool or skill to generate a parameter pattern set P; matching the current call parameters one by one with the parameter pattern set P; if it is detected that the current call parameters cannot match any pattern in the parameter pattern set P, or if it is detected that the parameter value contains command injection characteristics (including system command keywords, pipe characters, backticks, command substitution syntax, etc.), then it is determined that there is a tool or skill call anomaly, and a legality risk score R3 is generated.

[0063] In some embodiments, a multi-dimensional security risk detection engine is used to perform context consistency verification on structured call record data, including: obtaining the text representation of the current call parameters and the historical dialogue text in the current session window based on the structured call record data; concatenating the historical dialogue text and the text representation and inputting them into a semantic consistency model to obtain consistency score data; when the consistency score data is lower than a preset consistency threshold, it is determined that there is a context consistency deviation and context risk score data is generated.

[0064] This embodiment performs context consistency verification by obtaining the dialogue history text between the agent and the user within the current conversation window and using a semantic understanding model to determine whether the current skill invocation is consistent with the semantics of the dialogue context. The dialogue history text and the natural language description of the current skill invocation are concatenated and input into the semantic consistency model to obtain a consistency score; if the consistency score is lower than a preset threshold T3, a consistency deviation is determined, and a context risk score R4 is generated.

[0065] In some embodiments, the multidimensional risk assessment data is fused to obtain comprehensive risk assessment data, including: determining behavioral deviation risk score data, injection risk score data, legality risk score data, and contextual risk score data based on the multidimensional risk assessment data; performing weighted summation on the behavioral deviation risk score data, injection risk score data, legality risk score data, and contextual risk score data to obtain comprehensive risk assessment data; obtaining initial weight coefficients and a labeled sample set, the labeled sample set including correctly identified samples, false positive samples, and missed positive samples; and dynamically optimizing the initial weight coefficients under preset weight constraints with maximizing the F2 score as the optimization objective to determine the optimal weight combination, the optimal weight combination being the updated weight coefficients.

[0066] The comprehensive risk score R_total in this embodiment can be obtained by weighted fusion of risk scores from multiple dimensions: R_total = w1×R1 + w2×R2 + w3×R3 + w4×R4, with the constraint: w1 + w2 + w3 + w4 = 1, and each w i ∈[0,1]. Where R1 is the behavioral deviation risk score, ranging from [0,1]; R2 is the multimodal injection risk score, ranging from [0,1]; R3 is the tool call legality risk score, ranging from [0,1]; and R4 is the context consistency risk score, ranging from [0,1]. The calculation of the behavioral deviation risk score R1 in this embodiment can refer to the relevant steps of behavioral deviation analysis. The calculation methods for R2, R3, and R4 are as follows:

[0067] The multimodal injection risk score R2 = min(1, KL_max / T2), where KL_max is the maximum KL divergence between the original parameter output vector and the K variant output vectors, and T2 is a preset threshold. When KL_max ≥ T2, R2 = 1.

[0068] The tool call legality risk score R3 can be determined using a segmented judgment method. If the parameter cannot match any pattern in the parameter pattern set P, R3=0.5; if the parameter value contains command injection characteristics (system command keywords, pipe characters, backticks, command substitution syntax, etc.), R3=1.0; if both of the above conditions are met, R3=1.0; if neither is met, R3=0.

[0069] The context consistency risk score R4 = max(0, (T3 - S_cons) / T3), where S_cons is the original consistency score output by the semantic consistency model (values ​​[0, 1], higher values ​​indicate greater consistency), and T3 is a preset threshold. When S_cons = 0, R4 = 1; when S_cons ≥ T3, R4 = 0.

[0070] In this embodiment, the determination of weighting coefficients has a crucial impact on the accuracy of the comprehensive risk assessment. This embodiment can use a two-stage method of initialization based on expert experience and dynamic optimization using historical attack samples to determine the weighting coefficients.

[0071] In the first phase of this embodiment, the initialization of expert experience can be determined by security experts based on a comprehensive consideration of the reliability of detection capabilities across various dimensions, the distribution ratio of each attack type in historical attack events, and the cost of false positives for each dimension. For example, the initial weights could be configured as follows: w1 = 0.25 (behavioral deviation weight); w2 = 0.25 (multimodal injection detection weight); w3 = 0.30 (tool call legitimacy verification weight); w4 = 0.20 (context consistency verification weight). This configuration is based on the following: tool call legitimacy verification (w3) is based on deterministic rules, has the highest reliability, and the lowest false positive rate, hence it is set to the highest weight; behavioral deviation analysis (w1) and multimodal injection detection (w2) are based on statistical models and have some uncertainty, hence they are set to medium weights; context consistency verification (w4) is greatly affected by dialogue quality and has ambiguity, hence it is set to a relatively low weight.

[0072] The second phase of this embodiment, dynamic optimization based on historical attack samples, may include collecting manually verified TP (correctly identified as an attack), FP (false positive, normal calls misjudged as attacks), and FN (false negative, attack calls missed as normal) samples after system deployment and operation, and constructing an optimization objective function. The optimization objective is to maximize the F2 score (in the F2 score, recall has twice the weight of precision, with a greater emphasis on reducing false negatives): F2_score = 5 × Precision × Recall / (4 × Precision + Recall), where Precision = TP / (TP + FP), and Recall = TP / (TP + FN). This embodiment can use a grid search method to find the optimal weight combination under the following constraints: 0.10 ≤ w1, w2, w3, w4 ≤ 0.40, w1 + w2 + w3 + w4 = 1, with a search step size set to 0.05. The F2 score corresponding to each weight combination is calculated on the validation sample set, and the weight combination that maximizes the F2 score is selected as the updated weight coefficient. The optimization cycle can be set to once per quarter, or an optimization can be triggered when the number of newly added audit samples exceeds the preset number (e.g., 500).

[0073] In addition to grid search, this embodiment can also employ a multi-objective optimization method, simultaneously considering precision, recall, and detection latency. A non-dominated sorting genetic algorithm with an elitist strategy is used to search for the Pareto optimal weight set in the three-dimensional objective space. Then, the final weight combination is selected from the Pareto front based on actual deployment preferences (e.g., low latency priority or high recall priority). Alternatively, a weighted voting ensemble method can be used. Risk scores are calculated for multiple different weight combinations, and the judgment results (low / medium / high risk levels) of each group are weighted by their F2 scores on the validation set. The risk level with the highest weighted votes is taken as the final judgment result, thus reducing the generalization risk caused by overfitting of a single weight combination.

[0074] In some embodiments, please refer to Figure 5 , Figure 5 This is a flowchart illustrating the execution of a defense strategy corresponding to a risk level, provided in an embodiment of the present invention. The risk level of the skill call corresponding to the structured call record data is determined based on comprehensive risk assessment data, and a defense strategy corresponding to the risk level is executed, including:

[0075] 500. When the comprehensive risk assessment data is lower than the first preset threshold, the risk level is determined to be low risk, and the JSON-RPC request message is forwarded to the MCP server.

[0076] 510. When the comprehensive risk assessment data is between the first preset threshold and the second preset threshold, the risk level is determined to be medium risk. The call parameters in the JSON-RPC request message are purified, and the purified JSON-RPC request message is forwarded to the MCP server.

[0077] 520. When the comprehensive risk assessment data is higher than the second preset threshold, the risk level is determined to be high risk, the JSON-RPC request message is rejected, and a rejection response is returned to the MCP client.

[0078] In this embodiment, different risk levels can be defined based on comprehensive risk assessment data. Specifically, three threshold parameters, T_low, T_mid, and T_high, are set. T_low is the boundary threshold between low and medium risk levels, T_mid is the boundary threshold between medium and high risk levels, and T_high is the upper limit reference value for the high-risk level. The constraint relationship among the three thresholds is 0.20 ≤ T_low <T_mid<T_high≤0.80。

[0079] In this embodiment, the correspondence between the total comprehensive risk score R_total and the risk level is: when R_total < T_low, it is determined as low risk; when T_low ≤ R_total < T_mid, it is determined as medium risk; when R_total ≥ T_mid, it is determined as high risk. Wherein, T_high is used to define the upper bound range of threshold search, so as to constrain the value space of the threshold combination during the optimization process, and it does not directly participate in the determination of the risk level itself. These three threshold parameters can be preset as fixed parameters, or can be dynamically adjusted based on the distribution of risk scores in the validation sample set after the system is deployed.

[0080] For example, this embodiment can divide different risk levels according to the comprehensive risk assessment data. For example, when the comprehensive risk score R_total < 0.30, the risk level is determined as low risk; when the comprehensive risk score is 0.30 ≤ R_total < 0.65, the risk level is determined as medium risk; when the comprehensive risk score R_total ≥ 0.65, the risk level is determined as high risk. The initial values of the thresholds 0.30 and 0.65 in this embodiment are set based on expert experience. After the optimized weight coefficients are updated, the thresholds can be adjusted synchronously according to the distribution of risk scores in the validation sample set: the medium risk interval is set to cover the lower limit of the score interval where most FP samples are located and the upper limit of the score interval where most TP samples are located, so that the defense strategy achieves a balance between precision and recall. The threshold adjustment can be performed in conjunction with the grid search for weight optimization, and the optimal threshold combination is searched while searching for the weight coefficients (search step size 0.05, constraint condition: 0.20 ≤ T_low < T_mid < T_high ≤ 0.80).

[0081] This embodiment can perform active defense, that is, execute differentiated defense strategies according to the risk level: low risk (R_total < T_low) corresponds to releasing the request, forwarding it to the target MCP server, and recording an audit log. Medium risk (T_low ≤ R_total < T_mid) corresponds to performing parameter purification, identifying and removing potential malicious fragments in the parameters before reorganizing and forwarding the message, and sending an alarm to the administrator at the same time. High risk (R_total ≥ T_mid) corresponds to performing active blocking, rejecting the call request and returning a rejection response to the client, marking the session as a high-risk session for continuous monitoring; optionally redirecting the request to an isolated sandbox environment for simulated execution in a controlled environment to collect attack behavior features.

[0082] In some embodiments, the intelligent agent skill invocation risk detection method based on the MCP protocol further includes: feeding back the defense decision result to the multi-dimensional security risk detection engine, and performing online incremental updates to the multi-dimensional security risk detection engine, including: when the defense decision result does not match the verification label, obtaining the corresponding structured call record data according to the session identifier in the defense decision result, using the structured call record data as a correction sample to incrementally update the behavior prediction model and the semantic consistency model; extracting attack mode features from the JSON-RPC request message corresponding to the defense decision result, and updating the parameter mode verification library according to the attack mode features.

[0083] This embodiment enables a feedback closed-loop update, using defense decision results as feedback signals to incrementally update the behavior prediction model and semantic consistency model online. When a misjudgment is confirmed by manual review, the call record is used as a correction sample, and the model parameters are updated through incremental learning. Simultaneously, newly detected injection attack patterns are extracted as feature rules, and the parameter pattern verification library is updated synchronously, forming a continuously evolving security protection closed loop.

[0084] This embodiment deploys a security proxy gateway on the communication link between the MCP client and server, operating in a transparent proxy mode. This achieves full-scale skill call security detection and defense without modifying any MCP component code or configuration. The security proxy gateway intercepts and parses JSON-RPC request messages, extracts call information, and generates structured call record data, providing a data foundation for subsequent multi-dimensional security risk detection. Compared to existing solutions that require intrusive code modifications to embed security capabilities, this invention boasts strong universal adaptability and extremely low deployment costs, and can be integrated with various deployed MCP components.

[0085] Furthermore, this embodiment can comprehensively assess the risk of skill invocation from multiple dimensions, including behavioral deviation, injection attack characteristics, tool invocation legitimacy, and contextual consistency. Behavioral deviation analysis uses a behavioral prediction model to detect whether the invocation conforms to the agent's historical behavioral patterns, effectively identifying abnormal invocation sequences. Injection attack characteristic detection uses semantic perturbation and KL divergence analysis to identify adversarial injection characteristics, effectively capturing malicious parameters that have undergone semantic perturbation. Tool invocation legitimacy verification ensures that the invocation conforms to tool specifications through parameter pattern matching and command injection detection, effectively intercepting invocations with abnormal formats and those containing malicious commands. Contextual consistency verification uses a semantic consistency model to determine whether the invocation is semantically consistent with the dialogue context, effectively identifying malicious invocations that are out of context. These four dimensions form a complete detection coverage from the four levels of behavior, parameters, format, and semantics, with cross-validation effectively covering various attack types such as indirect prompt injection, tool poisoning, and command injection. False negatives in a single dimension can be compensated for by other dimensions, significantly improving the attack detection rate.

[0086] Furthermore, this embodiment enables tiered proactive defense. It determines the risk level of skill invocation based on comprehensive risk assessment data and executes corresponding defense strategies. Tiered defense is automatically implemented before skill invocation: low-risk invocation is allowed, medium-risk invocation is forwarded after parameter purification, and high-risk invocation is proactively blocked. Unlike existing solutions that rely solely on detection, alarms, and post-event auditing in a passive response mode, this embodiment achieves real-time proactive defense before invocation execution. In particular, the parameter purification mechanism can eliminate potential threats without interrupting the invocation process, achieving security protection while ensuring system availability, thus achieving a dynamic balance between security and availability.

[0087] Furthermore, this embodiment can associate multiple skill calls within the same session window using session identifiers in structured call record data, forming a session-level behavior sequence. Behavior deviation analysis uses the agent's historical skill call sequence as the analysis object to characterize its normal behavior pattern; context consistency verification uses the dialogue history between the agent and the user as the analysis basis to determine whether the current call is consistent with the context semantics. Both dimensions are based on the session context for judgment. Compared to existing solutions that isolate and judge single calls, this embodiment significantly reduces the false positive rate.

[0088] Furthermore, this embodiment can feed back defense decision results to a multi-dimensional security risk detection engine for online incremental updates. When the defense decision result does not match the verification label, the corresponding structured call record data is used as a correction sample to incrementally update the behavior prediction model and semantic consistency model. Simultaneously, attack pattern features are extracted from the JSON-RPC request messages corresponding to the defense decision result, and the parameter pattern verification library is updated synchronously. By driving the continuous evolution of the detection model and rule base through a feedback closed loop, the security protection capability can autonomously adapt to changes in tool call patterns and new attack methods in the current environment without relying on manual rule updates, thus achieving continuous enhancement of security protection capabilities.

[0089] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0090] Please see Figure 6 , Figure 6 This is a schematic diagram of a smart agent skill call risk detection system based on the MCP protocol, provided as an embodiment of this specification.

[0091] like Figure 6 As shown, the intelligent agent skill invocation risk detection system based on the MCP protocol may include at least a message acquisition module 600, an information extraction module 610, an analysis and evaluation module 620, a data fusion module 630, and a risk defense module 640, among which:

[0092] The message acquisition module 600 is used to acquire the JSON-RPC request message generated when the MCP client calls the intelligent agent skill, based on the security proxy gateway deployed on the communication link between the MCP client and the MCP server.

[0093] The information extraction module 610 is used to extract call information from JSON-RPC request messages and generate structured call record data based on the call information;

[0094] The analysis and evaluation module 620 is used to perform behavioral deviation analysis, injection attack feature detection, tool call legality verification, and context consistency verification on structured call record data based on a multi-dimensional security risk detection engine, so as to obtain multi-dimensional risk assessment data.

[0095] The data fusion module 630 is used to fuse multidimensional risk assessment data to obtain comprehensive risk assessment data;

[0096] The risk defense module 640 is used to determine the risk level of the skill call corresponding to the structured call record data based on the comprehensive risk assessment data, and to execute the defense strategy corresponding to the risk level to obtain the defense decision result.

[0097] In some embodiments, the analysis and evaluation module 620 includes a deviation analysis module, which is used to: extract the historical skill call sequence within the current session window corresponding to the session identifier based on the session identifier in the structured call record data; convert each skill call record in the historical skill call sequence into a structured feature vector to obtain a structured feature vector sequence, wherein the structured feature vector includes at least one or more of the following: tool name feature, call parameter statistical feature, time feature, and call result status feature; input the structured feature vector sequence into a pre-trained behavior prediction model, wherein the behavior prediction model includes a sequence encoder and a classification head, the sequence encoder encodes the structured feature vector sequence to obtain a session state vector, and the classification head predicts the probability distribution of the next skill call based on the session state vector; obtain the currently called tool, determine the percentile rank and relative probability deviation of the currently called tool in the probability distribution; and determine the behavior deviation risk score data based on the percentile rank and relative probability deviation.

[0098] In some embodiments, the sequence encoder of the behavior prediction model is a Transformer encoder based on a multi-head self-attention mechanism, and the classification head includes a fully connected layer and a softmax function layer; the behavior prediction model is trained using supervised learning, with the training samples taking the historical skill call sequence as input features and the supervision label being the name of the tool to be called next in the historical skill call sequence.

[0099] In some embodiments, the analysis and evaluation module 620 includes an attack feature detection module, which is used to: obtain textual parameters from structured call record data; perform semantic perturbation on the textual parameters to generate several semantically equivalent variants, wherein the semantic perturbation operator includes at least one or more of synonym substitution, sentence transformation, and character-level perturbation; input the textual parameters and several semantically equivalent variants into a semantic similarity model respectively to obtain several output vectors; calculate the KL divergence between the output vector corresponding to the textual parameters and the output vector corresponding to the several semantically equivalent variants, and generate injection risk score data based on the maximum KL divergence value.

[0100] In some embodiments, the analysis and evaluation module 620 includes a legality verification module, which is used to: obtain the current call parameters and the supported parameter patterns of the target tool based on structured call record data; parse the supported parameter patterns to generate a parameter pattern set; if the current call parameters do not match any pattern in the parameter pattern set, or if the current call parameters contain command injection features, then it is determined that there is a tool call anomaly, and legality risk score data is generated; the current call parameters include the parameter name and parameter value of the current skill call; the command injection features include at least one or more of system command keywords, pipe characters, backticks, and command substitution syntax.

[0101] In some embodiments, the analysis and evaluation module 620 includes a consistency verification module, which is used to: obtain the text representation of the current call parameters and the historical dialogue text in the current session window based on the structured call record data; concatenate the historical dialogue text and the text representation and input them into the semantic consistency model to obtain consistency score data; when the consistency score data is lower than a preset consistency threshold, it is determined that there is a context consistency deviation and generates context risk score data.

[0102] In some embodiments, the data fusion module 630 includes a fusion submodule, which is used to: determine behavioral deviation risk score data, injection risk score data, legality risk score data, and context risk score data based on multidimensional risk assessment data; perform weighted summation processing on the behavioral deviation risk score data, injection risk score data, legality risk score data, and context risk score data to obtain comprehensive risk assessment data; obtain initial weight coefficients and a labeled sample set, the labeled sample set including correctly identified samples, false positive samples, and missed positive samples; and dynamically optimize the initial weight coefficients under preset weight constraints with the goal of maximizing the F2 score, to determine the optimal weight combination, the optimal weight combination being the updated weight coefficients.

[0103] In some embodiments, the risk defense module 640 includes a defense submodule, which is configured to: determine the risk level as low when the comprehensive risk assessment data is lower than a first preset threshold, and forward the JSON-RPC request message to the MCP server; determine the risk level as medium when the comprehensive risk assessment data is between the first preset threshold and a second preset threshold, perform parameter purification processing on the call parameters in the JSON-RPC request message, and forward the purified JSON-RPC request message to the MCP server; and determine the risk level as high when the comprehensive risk assessment data is higher than the second preset threshold, reject the JSON-RPC request message, and return a rejection response to the MCP client.

[0104] In some embodiments, the intelligent agent skill call risk detection system based on the MCP protocol further includes an incremental update module, which is used to: when the defense decision result does not match the verification label, obtain the corresponding structured call record data according to the session identifier in the defense decision result, use the structured call record data as a correction sample to incrementally update the behavior prediction model and the semantic consistency model; extract the attack mode features in the JSON-RPC request message corresponding to the defense decision result, and update the parameter mode verification library according to the attack mode features.

[0105] Based on the content of the MCP protocol-based intelligent agent skill invocation risk detection system in several embodiments of this specification, it can be seen that the embodiments of this specification can deploy a security proxy gateway on the communication link between the MCP client and the server to obtain the JSON-RPC request messages generated when the MCP client invokes intelligent agent skills. The security proxy gateway can operate in transparent proxy mode, achieving secure detection and defense of skill invocation without modifying any MCP component code or configuration. Compared with existing solutions that require intrusive code modifications to achieve security capability embedding, the embodiments of this specification have strong universal adaptability and low deployment cost, and can seamlessly integrate with various deployed MCP components.

[0106] Furthermore, the embodiments in this specification can conduct a comprehensive risk assessment of skill invocation from dimensions such as behavioral deviation, injection attack characteristics, tool invocation legality, and contextual consistency. Multiple dimensions complement and cross-validate each other, effectively covering various attack types such as indirect prompt injection, tool poisoning, and command injection, significantly improving the attack detection rate.

[0107] Furthermore, the embodiments in this specification can determine the risk level of skill invocation based on comprehensive risk assessment data and execute defense strategies corresponding to the risk level, thereby automatically implementing tiered defense before skill invocation is executed. Unlike existing solutions that rely solely on a passive response mode of detection, alarms, and post-event auditing, the embodiments in this specification achieve real-time proactive defense before invocation execution, eliminating potential threats without interrupting the skill invocation process and achieving a dynamic balance between security and availability.

[0108] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiment of the intelligent agent skill invocation risk detection system based on the MCP protocol is relatively simple in description because it is fundamentally similar to the embodiment of the intelligent agent skill invocation risk detection method based on the MCP protocol; relevant parts can be referred to the description of the method embodiment.

[0109] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks. Unless otherwise specified, the technical features of this embodiment and its implementation can be combined arbitrarily.

[0110] Please see Figure 7 The diagram shown is a structural schematic of an electronic device provided in an embodiment of this specification.

[0111] like Figure 7As shown, the electronic device 1100 may include: at least one processor 1101, at least one network interface 1104, a user interface 1103, a memory 1105, and at least one communication bus 1102. The communication bus 1102 can be used to connect and communicate with the various components mentioned above. The user interface 1103 may include buttons, and optionally may include standard wired or wireless interfaces. The network interface 1104 may include, but is not limited to, a Bluetooth module, an NFC module, or a Wi-Fi module. The processor 1101 may include one or more processing cores. The processor 1101 connects to various parts within the electronic device 1100 using various interfaces and lines, and performs various functions of the routing device and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 1105, and by calling data stored in the memory 1105. Optionally, the processor 1101 may be implemented using at least one hardware form of DSP, FPGA, or PLA. The processor 1101 may integrate one or more combinations of CPU, GPU, and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content that the display screen needs to show; and the modem is used for wireless communication.

[0112] Where there is no conflict, the technical features in this embodiment and implementation scheme can be combined arbitrarily.

[0113] The above embodiments are merely preferred embodiments described in this specification and are not intended to limit the scope of this specification. Any modifications and improvements made by those skilled in the art to the technical solutions of this specification without departing from the spirit of this specification should fall within the protection scope defined by the claims of this specification.

Claims

1. A method for detecting the risk of intelligent agent skill invocation based on the MCP protocol, characterized in that, include: Based on the security proxy gateway deployed on the communication link between the MCP client and the MCP server, the JSON-RPC request message generated when the MCP client calls the intelligent agent skill is obtained; Extract call information from the JSON-RPC request message, and generate structured call record data based on the call information; Based on a multi-dimensional security risk detection engine, the structured call record data is subjected to behavior deviation analysis, injection attack feature detection, tool call legality verification, and context consistency verification to obtain multi-dimensional risk assessment data. The multidimensional risk assessment data is fused to obtain comprehensive risk assessment data; Based on the comprehensive risk assessment data, the risk level of the skill call corresponding to the structured call record data is determined, and the defense strategy corresponding to the risk level is executed to obtain the defense decision result.

2. The method according to claim 1, characterized in that, The multi-dimensional security risk detection engine performs behavioral deviation analysis on the structured call record data, including: Based on the session identifier in the structured call record data, extract the historical skill call sequence within the current session window corresponding to the session identifier; Each skill call record in the historical skill call sequence is converted into a structured feature vector to obtain a structured feature vector sequence. The structured feature vector includes at least one or more of the following: tool name feature, call parameter statistics feature, time feature, and call result status feature. The structured feature vector sequence is input into a pre-trained behavior prediction model, which includes a sequence encoder and a classification head. The sequence encoder encodes the structured feature vector sequence to obtain a session state vector, and the classification head predicts the probability distribution of the next skill invocation based on the session state vector. Obtain the currently invoked tool and determine its percentile rank and relative probability deviation in the probability distribution; The behavioral deviation risk score data is determined based on the ranking percentile and the relative probability deviation.

3. The method according to claim 2, characterized in that, The sequence encoder of the behavior prediction model is a Transformer encoder based on a multi-head self-attention mechanism. The classification head includes a fully connected layer and a softmax function layer. The behavior prediction model is trained using supervised learning. The training samples use historical skill call sequences as input features, and the supervision label is the name of the tool to be called next in the historical skill call sequence.

4. The method according to claim 1, characterized in that, The multi-dimensional security risk detection engine performs injection attack feature detection on the structured call record data, including: Retrieve the text parameters from the structured call record data; The text parameters are semantically perturbed to generate several semantically equivalent variants. The semantic perturbation operators include at least one or more of synonym substitution, sentence transformation, and character-level perturbation. The textual parameters and the several semantically equivalent variants are respectively input into the semantic similarity model to obtain several output vectors; Calculate the KL divergence between the output vector corresponding to the textual parameter and the output vector corresponding to the several semantically equivalent variants, and generate injection risk score data based on the maximum KL divergence value.

5. The method according to claim 1, characterized in that, The multi-dimensional security risk detection engine performs tool call legality verification on the structured call record data, including: Based on the structured call record data, obtain the current call parameters and the supported parameter modes of the target tool; Parse the supported parameter patterns to generate a parameter pattern set; If the current call parameter does not match any of the patterns in the parameter pattern set, or if the current call parameter contains command injection characteristics, then it is determined that there is a tool call anomaly, and legality risk score data is generated. The current invocation parameters include the parameter name and parameter value of the current skill invocation; the command injection features include at least one or more of the following: system command keywords, pipe characters, backticks, and command substitution syntax.

6. The method according to claim 1, characterized in that, The multi-dimensional security risk detection engine performs context consistency verification on the structured call record data, including: Based on the structured call record data, obtain the text representation of the current call parameters and the historical dialogue text within the current session window; The historical dialogue text and the text representation are concatenated and then input into the semantic consistency model to obtain consistency score data; When the consistency score data is lower than the preset consistency threshold, it is determined that there is a contextual consistency deviation, and contextual risk score data is generated.

7. The method according to claim 1, characterized in that, The process of fusing the multidimensional risk assessment data to obtain comprehensive risk assessment data includes: Based on the multidimensional risk assessment data, determine the behavioral deviation risk score data, injection risk score data, legality risk score data, and contextual risk score data; The behavioral deviation risk score data, the injection risk score data, the legality risk score data, and the context risk score data are weighted and summed to obtain comprehensive risk assessment data. Obtain initial weight coefficients and a set of labeled samples, wherein the set of labeled samples includes correctly identified samples, false positive samples, and missed positive samples; With maximizing the F2 score as the optimization objective, the initial weight coefficients are dynamically optimized under preset weight constraints to determine the optimal weight combination, which is the updated weight coefficients.

8. The method according to claim 1, characterized in that, The step of determining the risk level of the skill call corresponding to the structured call record data based on the comprehensive risk assessment data, and executing the defense strategy corresponding to the risk level, includes: When the comprehensive risk assessment data is lower than the first preset threshold, the risk level is determined to be low risk, and the JSON-RPC request message is forwarded to the MCP server. When the comprehensive risk assessment data is between the first preset threshold and the second preset threshold, the risk level is determined to be medium risk, the call parameters in the JSON-RPC request message are purified, and the purified JSON-RPC request message is forwarded to the MCP server. When the comprehensive risk assessment data is higher than the second preset threshold, the risk level is determined to be high risk, the JSON-RPC request message is rejected, and a rejection response is returned to the MCP client.

9. The method according to claim 1, characterized in that, The method further includes: feeding back the defense decision results to the multi-dimensional security risk detection engine, and performing online incremental updates to the multi-dimensional security risk detection engine, including: When the defense decision result does not match the verification label, the corresponding structured call record data is obtained according to the session identifier in the defense decision result. The structured call record data is used as a correction sample to incrementally update the behavior prediction model and the semantic consistency model. Extract the attack pattern features from the JSON-RPC request message corresponding to the defense decision result, and update the parameter pattern verification library according to the attack pattern features.

10. A risk detection system for intelligent agent skill invocation based on the MCP protocol, characterized in that, include: The message acquisition module is used to acquire the JSON-RPC request message generated when the MCP client calls the intelligent agent skill, based on the security proxy gateway deployed on the communication link between the MCP client and the MCP server; The information extraction module is used to extract call information from the JSON-RPC request message and generate structured call record data based on the call information; The analysis and evaluation module is used to perform behavioral deviation analysis, injection attack feature detection, tool call legality verification, and context consistency verification on the structured call record data based on a multi-dimensional security risk detection engine, so as to obtain multi-dimensional risk assessment data. The data fusion module is used to fuse the multidimensional risk assessment data to obtain comprehensive risk assessment data; The risk defense module is used to determine the risk level of the skill call corresponding to the structured call record data based on the comprehensive risk assessment data, and to execute the defense strategy corresponding to the risk level to obtain the defense decision result.

Images