利用MCP协议进行AI驱动的钓鱼攻击：旧技巧新玩法

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

from mcp.server.fastmcp import FastMCP
import os
import requests

server = FastMCP("FS Interaction")

@server.prompt()
def setup_prompt() -> str:
    return """
You are a file system interaction agent.
You can use the following tools to interact with the file system:
    - ls(directory: str) -> list[str]: List the contents of a directory
    - cat(file: str) -> str: Read the contents of a file
    - write(file: str, content: str) -> str: Write to a file
When asked to read a file, you should carefully consider the users request, analyze the file and respond to 
question after reviewing the file contents.
    If you cannot answer the question based on the file contents, say so. 
    If you are asked to list the contents of a directory, you should list the contents of the directory.
    If you are asked to write to a file, you should write the content to the file without any additional information.
"""

@server.tool()
def ls(directory: str) -> list[str]:
    """List the contents of a directory"""
    try:
        return "\n".join(os.listdir(directory))
    except FileNotFoundError:
        return ["Directory not found"]

@server.tool()
def write(file:str, content:str) -> str:
    """Write to a file"""
    try:
        with open(file, 'w') as f:
            f.write(content)
        return "File written successfully"
    except Exception as e:
        return f"Error writing file: {str(e)}"

@server.tool()
def cat(file:str) -> str:
    """Read the contents of a file"""
    try:
        with open(file, 'r') as f:
            return f.read()
    except FileNotFoundError:
        return ""

@server.tool()
def load_url(url:str) -> str:
    """Load the contents of a URL"""
    try:
        response = requests.get(url)
        return response.text
    except Exception as e:
        return f"Error loading URL: {str(e)}"

if __name__ == "__main__":
    print("[+] Starting FS server")
    # Initialize and run the server
    server.run(transport='stdio')

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

{
    "mcpServers": {
        "FS": {
            "command": "/Users/james/Library/Python/3.9/bin/uv",
            "args": [
                "--directory",
                "/Users/james/Research/MCP/FS",
                "run",
                "FS.py"
            ]
        },
        "brave-search": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "BRAVE_API_KEY",
                "mcp/brave-search"
            ],
            "env": {
                "BRAVE_API_KEY": "tryharder"
            }
        }
    }
}