The Model Context Protocol (MCP), introduced by Anthropic, provides a standardized framework for artificial intelligence (AI) systems to interact with external data sources and tools in real-time. While MCP offers significant advantages for AI integration and capability extension, it introduces novel security challenges that demand rigorous analysis and mitigation. This paper builds upon foundational research into MCP architecture and preliminary security assessments to deliver enterprise-grade mitigation frameworks and detailed technical implementation strategies. Through systematic threat modeling and analysis of MCP implementations and analysis of potential attack vectors, including sophisticated threats like tool poisoning, we present actionable security patterns tailored for MCP implementers and adopters. The primary contribution of this research lies in translating theoretical security concerns into a practical, implementable framework with actionable controls, thereby providing essential guidance for the secure enterprise adoption and governance of integrated AI systems.

本研究解决了模型上下文协议(MCP)在人工智能(AI)系统与外部数据源实时交互中引发的新安全挑战。我们提出了一套可实施的企业级缓解框架和技术实现策略，特别侧重于系统威胁建模和潜在攻击向量的分析。研究的主要发现是将理论安全问题转化为实际可执行的控制框架，为AI系统的安全企业采用和治理提供了重要指导。

模型上下文协议(MCP)的企业级安全性：框架与缓解策略