[{"data":1,"prerenderedAt":204},["ShallowReactive",2],{"copy:zh:site:":3,"copy:zh:security:incident,ui,mitigations,incidents.2025-06-mcp-inspector-rce,incidents.2025-07-supabase-mcp-token-leak.title,incidents.2025-06-echoleak-m365-copilot.title":123,"copy:zh:site:common":202},{"common":4,"nav":16,"footer":44,"home":51,"error":116},{"skip":5,"menu":6,"language":7,"sections":8,"footer":9,"tool":10,"home":11,"breadcrumbs":12,"copy":13,"copied":14,"download":15},"跳转到正文","菜单","语言","章节","页脚","工具","首页","面包屑导航","复制","已复制","下载",{"groups":17,"items":25},{"build":18,"connect":19,"instruct":20,"run":21,"web":22,"secure":23,"track":24},"构建","连接","编写指令","运行","开放你的网站","安全","跟踪",{"models":26,"cost":27,"frameworks":28,"mcp":29,"mcpConfig":30,"mcpClients":31,"agentsMd":32,"files":33,"openclaw":34,"agentReady":35,"llmsTxt":36,"robotsTxt":37,"apiCatalog":38,"bots":39,"security":40,"incidents":41,"checklist":42,"changelog":43},"模型与 API 价格","Agent 成本计算器","框架与 SDK","MCP 服务器","MCP 配置生成器","MCP 客户端","AGENTS.md 生成器","指令文件","自托管 OpenClaw","适配 Agent 的网站","llms.txt 生成器","面向 AI 机器人的 robots.txt","API 目录生成器","AI 机器人目录","Agent 安全","事故记录","安全检查清单","更新日志",{"about":45,"privacy":46,"terms":47,"sitemap":48,"disclaimer":49,"checked":50},"关于","隐私","条款","网站地图","为 AI agent 开发者提供的独立参考资料。与此处提及的任何厂商均无关联。","事实核查日期：{date}",{"seo":52,"eyebrow":55,"title":56,"lead":57,"ctaMcp":58,"ctaCost":59,"ctaAgents":60,"sheetLabel":61,"sheetTitle":62,"sheet":63,"sheetNote":69,"sectionsTitle":70,"sections":71,"latestTitle":99,"allChanges":100,"rulesTitle":101,"rules":102,"aboutLink":115},{"title":53,"description":54},"DotsAgent：构建 AI agent 的参考资料与工具","LLM API 价格、agent 成本计算器、适用于 13 个客户端的 MCP 配置、AGENTS.md 和 llms.txt 生成器，以及 agent 安全指南。免费提供，支持 18 种语言。","面向 AI agent 开发者","Agent 开发者的案头参考","涵盖 agent 开发所需的价格、协议、配置文件和安全指南，所有信息均经厂商官方文档核实。查找信息、生成所需文件，然后继续编写代码。","生成 MCP 配置","计算 agent 任务成本","编写 AGENTS.md","最新数据","技术栈概览",{"mcp":64,"openclaw":65,"cheapest":66,"models":67,"servers":29,"bots":68},"MCP 规范","OpenClaw","最低价模型，$\u002F百万输入\u002F输出 tokens","已统计价格的模型","已跟踪的 AI 机器人","每项数据均经人工对照厂商文档核实。","网站内容",{"models":72,"mcp":76,"instructions":79,"frameworks":82,"openclaw":85,"agentReady":88,"security":92,"changelog":95},{"title":73,"body":74,"unit":75},"模型与价格","并列比较每百万输入、输出和缓存 token 的价格，并提供计算器，估算完整 agent 运行的费用。","个模型",{"title":29,"body":77,"unit":78},"Model Context Protocol 服务器目录，以及配置生成器，可为每种客户端生成对应的配置文件。","台服务器",{"title":33,"body":80,"unit":81},"编写 AGENTS.md，并了解各工具如何读取 CLAUDE.md、.cursor\u002Frules 等类似文件。","种文件格式",{"title":28,"body":83,"unit":84},"按语言、许可证、MCP 支持和多 agent 功能对比 agent 框架与厂商 SDK。","个框架",{"title":34,"body":86,"unit":87},"逐步指导你在自己的设备或服务器上安装、配置和更新 OpenClaw。","当前版本",{"title":89,"body":90,"unit":91},"适配 agent 的网站","生成 llms.txt、面向 AI crawler 的 robots.txt 规则和 api-catalog，并通过 user agent 查询任意机器人。","个已收录机器人",{"title":40,"body":93,"unit":94},"了解 agent 面临的 OWASP 风险、真实事件记录，以及上线前可逐项核对的清单。","起已记录事件",{"title":96,"body":97,"unit":98},"API 更新日志","按日期记录模型 API、SDK 和协议的变更，并附上厂商公告链接。","条记录","最新变更","所有变更","我们如何确保信息准确",[103,106,109,112],{"title":104,"body":105},"事实均有来源。","每项价格、版本和 flag 都链接到对应的供应商页面，方便你自行核实。",{"title":107,"body":108},"定期核查。","每个页面都会显示上次核查信息的时间；过时的条目会重新核查或移除。",{"title":110,"body":111},"不接受付费推广。","没有人能付费获得收录、提高排名或得到更好的描述。",{"title":113,"body":114},"工具在浏览器中运行。","生成器和计算器都在本地运行，你输入的内容不会发送到服务器。","关于 DotsAgent",{"title":117,"body":118,"home":119,"popular":120,"failed":121,"failedBody":122},"找不到页面","此地址没有对应的页面。页面可能已迁移，或者链接中有拼写错误。","前往首页","热门工具","出了点问题","我们这边未能加载此页面。请稍后再试，或从首页开始浏览。",{"incident":124,"ui":130,"mitigations":133,"incidents":179},{"crumb":125,"whatTitle":126,"whyTitle":127,"doTitle":128,"toChecklist":129},"事件记录","事件经过","攻击奏效的原因","应对措施","查看安全检查清单",{"crumb":131,"sources":132},"智能体安全","来源",{"lethalTrifecta":134,"designPatterns":137,"camel":140,"leastPrivilege":143,"humanApproval":146,"sandboxing":149,"egressControl":152,"noPublicControlPlane":155,"mcpTokenAudience":158,"sessionIsolation":161,"supplyChainVetting":164,"inboundAccessControl":167,"ciSecretIsolation":170,"outputHandling":173,"verifyAgentSignatures":176},{"title":135,"body":136},"拆解致命三要素","Simon Willison 的原则是：如果智能体既能读取私有数据，又会接触不可信内容，还能向外发送数据，那么它读取的任何文本都可能被用来攻击你。对每个智能体或会话，至少移除这三项能力中的一项。例如，负责分类公开议题的智能体不应接触机密；持有机密的智能体则不应拥有向外发送数据的渠道。",{"title":138,"body":139},"限制智能体处理不可信输入后的权限","关于智能体安全设计模式的研究确立了一条规则：智能体摄取不可信输入后，该输入绝不能触发会产生重大影响的操作。这些模式包括 action-selector、plan-then-execute、双 LLM 和上下文最小化。每个工作流选择一种模式，例如，在智能体读取任何不可信数据之前先固定执行计划。",{"title":141,"body":142},"用 CaMeL 跟踪数据流","CaMeL 将智能体拆分为两部分：特权规划器根据用户请求编写代码，隔离模型则处理不可信数据。隔离侧的值会附带能力标签，工具运行前由策略检查这些标签。论文报告称，CaMeL 在可证明安全的前提下解决了 77% 的 AgentDojo 任务，而未设防的智能体解决了 84%。",{"title":144,"body":145},"使用最小权限凭据","默认只授予智能体只读、限定项目范围的访问权限，绝不要使用管理员密钥或 service_role 密钥；在 Supabase 中，service_role 密钥会绕过行级安全策略。将 CI 和仓库令牌的权限限制在其对应的单个任务范围内。Amazon Q Developer 事件的根源，是 CodeBuild 中权限范围过大的 GitHub 令牌。",{"title":147,"body":148},"重大操作须经人工批准","对于会写入、删除、发送或花费资源的工具调用，要求人工确认；无人响应时应默认拒绝。Supabase 建议对 MCP 工具调用进行人工审批；在 OpenClaw 中，将 tools.exec.ask 设为 always，并将 askFallback 保持为 deny。展示完整参数，让审核者看清实际将要执行的操作。",{"title":150,"body":151},"对代码和工具执行进行沙箱隔离","在不含凭据、且只能访问工作区的容器或 VM 中运行 shell 命令和生成的代码。OpenClaw 默认关闭沙箱，并在网关主机上将 tools.exec.security 设为 full，因此应启用沙箱，将 exec security 设为 deny 或 allowlist，将 fs.workspaceOnly 设为 true，并保持 elevated mode 关闭。运行 openclaw sandbox explain 确认设置结果。",{"title":153,"body":154},"限制出站网络访问","默认拒绝智能体和 MCP 服务器的出站流量，然后只允许各自必需的主机。切勿自动批准对多租户主机的请求，因为任何人都可能在这类主机上发布内容；CVE-2026-54316 正是利用这一点，将 huggingface.co 变成了数据外泄通道。邮件服务器只应访问其邮件 API，不应访问其他任何地址，postmark-mcp 就展示了这一点。",{"title":156,"body":157},"不要将控制面暴露到互联网","将智能体网关、仪表盘和调试代理绑定到 loopback，并要求至少 24 个字符的令牌，例如使用 openssl rand -hex 32 生成。通过 SSH 隧道或 Tailscale Serve 远程访问，并且只有在启用密码认证时才使用 Tailscale Funnel。定期运行 openclaw security audit --deep。",{"title":159,"body":160},"验证 MCP 令牌的受众","MCP 授权规范要求服务器拒绝并非为其签发的访问令牌，并禁止将客户端令牌转发给上游 API。客户端应发送 RFC 8707 资源指示符，使每个令牌都绑定到单个服务器。代理服务器必须获得每个客户端的授权，否则就会成为混淆代理。",{"title":162,"body":163},"隔离 MCP 会话和租户","为每个会话创建独立的服务器和传输实例，不要让多个客户端共享同一个实例。将每个会话和任务绑定到创建它的已认证主体，并在每次请求时检查绑定关系。2026 年的两份 MCP SDK 安全公告都源于共享状态或未绑定的状态。",{"title":165,"body":166},"审查技能、插件和 MCP 服务器","固定到确切版本，每次更新前查看 diff，并检查 VirusTotal 等扫描工具的判定结果以及 ClawHub 的安全审计状态。批准服务器时，对工具描述计算哈希，并在描述发生变化时发出警报，以便发现 rug pull。OpenClaw 安装时不会内置拦截机制，因此请自行设置 security.installPolicy。",{"title":168,"body":169},"控制谁可以向智能体发送消息","私信访问仅允许通过配对或白名单；在群聊中，要求先提及智能体，它才可以采取行动；并将 session.dmScope 设为 per-channel-peer，避免不同发送者共享上下文。任何能向智能体发送消息的人都可以尝试指使它，因此发送者名单也是攻击面的一部分。",{"title":171,"body":172},"不要在不可信的 CI 运行中暴露密钥","不要在外部人员可通过 pull request、issue 或评论触发的工作流中，使用带有仓库密钥的智能体。将这些事件中的标题、描述和评论都视为恶意输入。如果某个步骤确实需要密钥，只能在维护者批准该次运行后执行。",{"title":174,"body":175},"将模型输出视为不可信内容","渲染模型输出前先进行编码或清理，绝不要未经检查就将其传给 shell、SQL 查询或浏览器。阻止自动加载 Markdown 图片和指向外部域名的链接，并设置严格的 Content Security Policy。EchoLeak 通过会自行加载的 URL 将数据传了出去。",{"title":177,"body":178},"验证智能体签名，再进行授权","要识别调用你的网站或 API 的智能体，请使用 operator 在 \u002F.well-known\u002Fhttp-message-signatures-directory 发布的密钥验证其 Web Bot Auth 签名。ChatGPT agent 使用 Signature-Agent https:\u002F\u002Fchatgpt.com 进行签名。有效签名只能说明谁在运营该智能体，不能说明是哪位用户发起了请求，也不能说明该用户有权执行什么操作，因此仍须对每个请求单独授权。",{"2025-06-mcp-inspector-rce":180,"2025-07-supabase-mcp-token-leak":198,"2025-06-echoleak-m365-copilot":200},{"title":181,"seoTitle":182,"summary":183,"tags":184,"what":188,"why":191,"do":193},"MCP Inspector 代理可被浏览器用于远程代码执行","浏览器可利用 MCP Inspector 实现 RCE（CVE-2025-49596）","0.14.1 之前的 MCP Inspector 会启动一个无身份验证的本地代理，网页可访问该代理并在开发者的机器上执行代码。CVSS 9.4。",[185,186,187],"MCP","RCE","开发者工具",[189,190],"MCP Inspector 是开发者用来测试和调试 MCP server 的工具。0.14.1 之前的版本会启动一个无需身份验证即可接受请求的本地代理。开发者浏览器中打开的网页可以访问该代理，并利用它在机器上执行代码。","该漏洞编号为 CVE-2025-49596，CVSS 评分为 9.4；0.14.1 是首个不受影响的版本。",[192],"本地开发者工具通常认为，只要监听 localhost 就是安全的。但浏览器也运行在 localhost 上，它加载的网页可以向本地端口发送请求，因此网页可以访问未设置身份验证的本地服务。",[194,195,196,197],"将 MCP Inspector 更新到 0.14.1 或更高版本。","为每个本地代理和调试服务器配置 token，即使它们只监听 loopback 也不例外。","不使用 Inspector 时将其关闭。","在不含任何凭据的容器或 VM 中测试未知的 MCP 服务器。",{"title":199},"Supabase MCP 智能体通过支持工单泄露 token",{"title":201},"EchoLeak：Microsoft 365 Copilot 遭遇零点击数据窃取",{"common":203},{"skip":5,"menu":6,"language":7,"sections":8,"footer":9,"tool":10,"home":11,"breadcrumbs":12,"copy":13,"copied":14,"download":15},1790863382274]