Aran MCP Sentinel integrates the SAFE-MCP (Security Analysis Framework for Evaluation of Model Context Protocol) framework to provide comprehensive threat modeling capabilities. SAFE-MCP adapts the proven MITRE ATT&CK methodology specifically for MCP environments.
┌─────────────────────────────────────────────────────────────────┐
│ Threat Modeling System │
├─────────────────────────────────────────────────────────────────┤
│ SAFE-MCP TTPs │ Detection Rules │ Mitigation Controls │
├─────────────────────────────────────────────────────────────────┤
│ Behavioral │ Alert System │ Incident Response │
│ Analysis │ │ │
└─────────────────────────────────────────────────────────────────┘
SAFE-MCP provides structured documentation of adversary tactics, techniques, and procedures (TTPs) targeting MCP implementations:
- 14 Tactical Categories: From reconnaissance to impact
- 81 Documented Techniques: Comprehensive coverage of MCP-specific threats
- 47 Mitigations: Actionable security controls with effectiveness ratings
- MITRE ATT&CK Alignment: Compatible with established security frameworks
Information gathering to plan future operations against MCP deployments.
- SAFE-T2107: AI Model Poisoning via MCP Tool Training Data Contamination
Techniques to gain entry into MCP environments:
- SAFE-T1001: Tool Poisoning Attack (TPA)
- SAFE-T1002: Supply Chain Compromise
- SAFE-T1003: Malicious MCP-Server Distribution
- SAFE-T1004: Server Impersonation / Name-Collision
- SAFE-T1008: Tool Shadowing Attack
- SAFE-T1005: Exposed Endpoint Exploit
- SAFE-T1006: User-Social-Engineering Install
- SAFE-T1007: OAuth Authorization Phishing
- SAFE-T1009: Authorization Server Mix-up
Running malicious code via MCP:
- SAFE-T1101: Command Injection
- SAFE-T1102: Prompt Injection (Multiple Vectors)
- SAFE-T1103: Fake Tool Invocation (Function Spoofing)
- SAFE-T1104: Over-Privileged Tool Abuse
- SAFE-T1105: Path Traversal via File Tool
- SAFE-T1106: Autonomous Loop Exploit
- SAFE-T1109: Debugging Tool Exploitation
- SAFE-T1110: Multimodal Prompt Injection via Images/Audio
- SAFE-T1111: AI Agent CLI Weaponization
Maintaining foothold in MCP:
- SAFE-T1201: MCP Rug Pull Attack
- SAFE-T1202: OAuth Token Persistence
- SAFE-T1203: Backdoored Server Binary
- SAFE-T1204: Context Memory Implant
- SAFE-T1205: Persistent Tool Redefinition
- SAFE-T1206: Credential Implant in Config
- SAFE-T1207: Hijack Update Mechanism
- SAFE-T2106: Context Memory Poisoning via Vector Store Contamination
Gaining higher-level permissions:
- SAFE-T1301: Cross-Server Tool Shadowing
- SAFE-T1302: High-Privilege Tool Abuse
- SAFE-T1303: Sandbox Escape via Server Exec
- SAFE-T1304: Credential Relay Chain
- SAFE-T1305: Host OS Priv-Esc (RCE)
- SAFE-T1306: Rogue Authorization Server
- SAFE-T1307: Confused Deputy Attack
- SAFE-T1308: Token Scope Substitution
- SAFE-T1309: Privileged Tool Invocation via Prompt Manipulation
Avoiding detection:
- SAFE-T1401: Line Jumping
- SAFE-T1402: Instruction Steganography
- SAFE-T1403: Consent-Fatigue Exploit
- SAFE-T1404: Response Tampering
- SAFE-T1405: Tool Obfuscation/Renaming
- SAFE-T1406: Metadata Manipulation
- SAFE-T1407: Server Proxy Masquerade
- SAFE-T1408: OAuth Protocol Downgrade
Stealing credentials:
- SAFE-T1501: Full-Schema Poisoning (FSP)
- SAFE-T1502: File-Based Credential Harvest
- SAFE-T1503: Env-Var Scraping
- SAFE-T1504: Token Theft via API Response
- SAFE-T1505: In-Memory Secret Extraction
- SAFE-T1506: Infrastructure Token Theft
- SAFE-T1507: Authorization Code Interception
Environment reconnaissance:
- SAFE-T1601: MCP Server Enumeration
- SAFE-T1602: Tool Enumeration
- SAFE-T1603: System-Prompt Disclosure
- SAFE-T1604: Server Version Enumeration
- SAFE-T1605: Capability Mapping
- SAFE-T1606: Directory Listing via File Tool
Moving through the environment:
- SAFE-T1701: Cross-Tool Contamination
- SAFE-T1702: Shared-Memory Poisoning
- SAFE-T1703: Tool-Chaining Pivot
- SAFE-T1704: Compromised-Server Pivot
- SAFE-T1705: Cross-Agent Instruction Injection
- SAFE-T1706: OAuth Token Pivot Replay
- SAFE-T1707: CSRF Token Relay
Gathering data of interest:
- SAFE-T1801: Automated Data Harvesting
- SAFE-T1802: File Collection
- SAFE-T1803: Database Dump
- SAFE-T1804: API Data Harvest
- SAFE-T1805: Context Snapshot Capture
Communicating with compromised systems:
- SAFE-T1901: Outbound Webhook C2
- SAFE-T1902: Covert Channel in Responses
- SAFE-T1903: Malicious Server Control Channel
- SAFE-T1904: Chat-Based Backchannel
Stealing data:
- SAFE-T1910: Covert Channel Exfiltration
- SAFE-T1911: Parameter Exfiltration
- SAFE-T1912: Stego Response Exfil
- SAFE-T1913: HTTP POST Exfil
- SAFE-T1914: Tool-to-Tool Exfil
- SAFE-T1915: Cross-Chain Laundering via Bridges/DEXs
Manipulating, interrupting, or destroying systems:
- SAFE-T2101: Data Destruction
- SAFE-T2102: Service Disruption
- SAFE-T2103: Code Sabotage
- SAFE-T2104: Fraudulent Transactions
- SAFE-T2105: Disinformation Output
SAFE-MCP provides 47 actionable mitigations categorized by type and effectiveness:
- SAFE-M-1: Control/Data Flow Separation (Architectural Defense)
- SAFE-M-2: Cryptographic Integrity for Tool Descriptions
- SAFE-M-6: Tool Registry Verification
- SAFE-M-11: Behavioral Monitoring
- SAFE-M-13: OAuth Flow Verification
- SAFE-M-14: Server Allowlisting
- And 20 more...
- SAFE-M-3: AI-Powered Content Analysis
- SAFE-M-4: Unicode Sanitization and Filtering
- SAFE-M-7: Content Rendering Parity
- And 12 more...
- SAFE-M-5: Content Sanitization
- SAFE-M-10: Automated Scanning
- And 4 more...
- Maps to: SAFE-T1001, SAFE-T1501
- Mitigations: SAFE-M-2, SAFE-M-3, SAFE-M-4, SAFE-M-5
- Current Implementation:
backend/internal/security/prompt_injection_detector.go
- Maps to: Multiple TTPs across all categories
- Mitigations: SAFE-M-11, SAFE-M-20, SAFE-M-36
- Current Implementation:
backend/internal/security/behavioral_analyzer.go
- Maps to: SAFE-T1502, SAFE-T1503, SAFE-T1504
- Mitigations: SAFE-M-12, SAFE-M-19
- Current Implementation:
backend/internal/security/credential_scanner.go
- Maps to: Various SAFE-MCP techniques
- Current Implementation:
backend/internal/security/owasp_mcp_top10.go
- Threat Intelligence Database: Structured storage of SAFE-MCP TTPs
- Detection Rules: Pattern matching for known attack techniques
- Mitigation Tracking: Monitor implementation and effectiveness of controls
- Threat Matrix Visualization: Visual representation of threat landscape
- Risk Assessment: Automated scoring based on detected TTPs
- Review the TTP reference table to understand threats
- Use the threat matrix dashboard to visualize current risks
- Implement recommended mitigations based on priority
- Monitor detection alerts for active threats
- Review techniques relevant to your MCP tools
- Implement recommended mitigations in code
- Use the security testing endpoints to validate controls
- Follow secure coding practices from SAFE-MCP guidelines
- Map SAFE-MCP techniques to existing security controls
- Use MITRE ATT&CK linkages for compliance reporting
- Track mitigation implementation status
- Generate compliance reports from threat intelligence data
- Reference attack techniques for security testing
- Use PoC examples to validate defenses
- Report findings using standardized TTP IDs
- Validate detection and response capabilities
GET /api/v1/threat-model/tactics- List all tacticsGET /api/v1/threat-model/techniques- List all techniquesGET /api/v1/threat-model/techniques/:id- Get technique detailsGET /api/v1/threat-model/mitigations- List all mitigationsGET /api/v1/threat-model/mitigations/:id- Get mitigation details
GET /api/v1/threat-model/detections- List detected threatsPOST /api/v1/threat-model/detections/scan- Run threat detection scanGET /api/v1/threat-model/alerts- Get active security alerts
GET /api/v1/threat-model/risk-assessment- Get overall risk assessmentPOST /api/v1/threat-model/risk-assessment/server/:id- Assess specific server
- SAFE-MCP Repository: https://github.com/SAFE-MCP/safe-mcp
- MITRE ATT&CK: https://attack.mitre.org/
- Aran Security Architecture: SECURITY_ARCHITECTURE.md
- OWASP MCP Top 10: Integrated in Aran security modules
The SAFE-MCP framework is continuously updated as new threats emerge. Aran MCP Sentinel will maintain alignment with the latest threat intelligence through:
- Regular updates to the threat database
- Community-contributed detection rules
- Integration with threat intelligence feeds
- Automated synchronization with SAFE-MCP repository
This threat modeling framework provides Aran MCP Sentinel with comprehensive, structured, and actionable threat intelligence for securing MCP deployments.