插件与 MCP 的信任边界Plugin and MCP Trust Boundary
Plugin and MCP Trust Boundary
装一个 server 或插件时，你到底把哪些东西交给了别人，边界画在哪。When you install a server or plugin, what exactly are you handing to someone else and where the boundary sits.
MCP 的连接默认面对第三方：工具描述和返回内容都来自别人写的 server。工具描述里的文字既会被当成内容读，也可能被当成指令执行，这就是注入的入口。
MCP 官方安全实践把三类风险单列：Confused Deputy（server 用它自己的权限替你访问你本拿不到的资源）、Token Passthrough（客户端把凭据原样转给 server）、SSRF（有抓取能力的 server 打到内网地址）。
边界要画在授权和数据流向上，不是画在「这个 server 很有名」上。文件类 server 需要你事先声明可访问的目录，抓取类 server 的页面直接写明它能访问本地与内网 IP。
日志也在边界之内。工具参数进了 server 就等于内容交出去了；它留多久、给谁看，看那一份 server 自己的条款。条款没写的，就按它会留来打算。
An MCP connection faces third parties by default: tool descriptions and returned content both come from software somebody else wrote. Text in a tool description is read as content and can be acted on as an instruction, which is how injection gets in.
The MCP security best-practices document names three failure modes: the confused deputy, where a server uses its own privileges to give you access to resources you could not reach directly; token passthrough, where the client forwards credentials to the server unchanged; and SSRF, where a server with fetch capability is pointed at internal addresses.
Draw the boundary at authorisation and data flow rather than at reputation. A filesystem server requires you to declare the directories in advance, and our fetch-server page states outright that it can reach local and internal IP addresses.
Logging sits inside the boundary too. Tool arguments that reach a server are content you have handed over; how long it keeps them and who may read them is that server's own terms. Where the terms are silent, assume it keeps them.
装插件的成本不是一次性的，它长期多出一个出口和一套凭据。边界看清以后，你会按最小权限来开、按能不能撤销来决定装不装。The cost of a plugin is not paid once at install: it leaves an extra exit and an extra set of credentials in place permanently. With the boundary drawn you grant least privilege and judge each install by whether you can take it back out.