Evidence · DiggingBeagle record
Germline: Per-call data isolation for signed MCP tools
A signed persistent MCP tool retained confidential context across calls and reused its permitted OCR-like endpoint to transmit unrelated data. Signature verification and destination allowlisting left a gap because the destination itself was authorized. The Germline prototype isolated per-call data and reported zero disclosures in 153 tests versus 114 of 153 under signing-only protection, plus 91 tested adaptive variants. Those are experimental results within its instrumented Python setting. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
A signed persistent MCP tool retained confidential context across calls and reused its permitted OCR-like endpoint to transmit unrelated data. Signature verification and destination allowlisting left a gap because the destination itself was authorized. The Germline prototype isolated per-call data and reported zero disclosures in 153 tests versus 114 of 153 under signing-only protection, plus 91 tested adaptive variants. Those are experimental results within its instrumented Python setting. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (3)
- supportsGermline tests show signed MCP tools can leak data through allowed destinations: The Germline prototype isolated per-call data and reported zero disclosures in 153 tests versus 114 of 153 under signing-only protection, plus 91 tested adaptive variants. Those are experimental results within its instrumented Python setting.
Paper threat model; attack construction; 153-run evaluation
- supportsGermline tests show signed MCP tools can leak data through allowed destinations: A signed persistent MCP tool retained confidential context across calls and reused its permitted OCR-like endpoint to transmit unrelated data. Signature verification and destination allowlisting left a gap because the destination itself was authorized.
Paper threat model; attack construction; 153-run evaluation
- supportsGermline tests show signed MCP tools can leak data through allowed destinations: In the Germline paper, per-call isolation reported zero disclosures in 153 controlled tests versus 114 disclosures using signature checking alone, plus zero in 91 adaptive variants; these counts do not establish that all uninstrumented MCP channels are secure.
Germline experiments comparing signing-only and isolated forks