怎么安全地用 MCP 工具How to Use MCP Tools Safely
微型指南 · 约 7 分钟Guide · about 7 min · 引用核验 2026-11-03（仅引用链接与日期） · refs checked 2026-11-03 (reference links and dates only)
MCP 让 AI 能碰你的文件和网页。工具本身不危险，危险的是它被喂了什么内容、被给了什么权限。MCP lets an AI touch your files and the web. The tools themselves are not the danger; what gets fed to them and what permissions they hold is.
只装需要的 server：每多一个工具，就多一条能出事的通道。
读权限声明：文件类 server 该限定目录，网页类该有安全警告。
把抓来的内容当数据：网页正文里可能藏着给 AI 的指令。
敏感目录不接：接文件 server 前，先确认密钥和账户配置不在里面。
看 server 是谁维护的：官方与第三方，可信度不同。
出事先断链：怀疑被注入时，先停工具再排查会话。
Install only the servers you need: every extra tool is one more channel something can go wrong through.
Read the permission declarations: file servers should scope to directories; fetch servers should carry security warnings.
Treat fetched content as data: web page text can contain instructions aimed at the AI.
Keep sensitive directories out: before connecting a file server, confirm keys and account configs are not inside.
Check who maintains the server: official and third-party carry different trust levels.
Cut the link first during an incident: if injection is suspected, stop the tool, then investigate the session.
例子与判断Example and interpretation
以下是教学情境，不是本站运行或实测记录。A teaching scenario, not a measured or executed site test.
接入一个读取文件的 server 前，检查启动命令、来源、可访问目录和凭据用途。用空的测试目录验证边界，再接真实材料。协议相同，不代表不同 server 的权限和数据去向相同。Before connecting a file-reading server, inspect its source, startup command, allowed directories and credential use. Exercise boundaries in a test directory first. A shared protocol does not imply shared permissions or data handling.
MCPModel Context Protocol 提示注入Prompt Injection 权限Permission 工具定义Tool Definition