做 LLM Agent 安全防护的团队终于有了一个可落地的方案——SafeMCP 在服务器端用前瞻推理主动过滤危险工具调用，比事后审计更有效，建议关注其开源实现。
SafeMCP 是一个服务器端防御插件，针对 LLM Agent 使用 MCP 协议时因动作空间扩大带来的安全风险。它通过内部世界模型进行前瞻推理，实现两层防御：主动工具过滤限制危险权限扩展，以及即时干预作为故障安全机制。训练采用三阶段流程：环境动态基础、安全策略初始化和带双重可验证奖励的强化学习。在 PowerSeeking Bench、ToolEmu 和 AgentHarm 上的实验表明，SafeMCP 能在降低风险的同时保持 Agent 的实用性。
SafeMCP: Proactive Power Regulation for LLM Agent Defense via Environment-Grounded Look-Ahead Reasoning
As Large Language Model (LLM) agents increasingly leverage the Model Context Protocol (MCP) to operate in complex environments, the expansion of their action spaces offers agents unsafe capabilities and underscores the risk of power-seeking. While broad action space and greater environment influence are essential for task fulfillment, they create a fragile risk surface where minor errors or hallucinations are magnified into catastrophic failures. In response, we propose SafeMCP, a {server-side} defense plugin that constrains tool acquisition via predictive reasoning regarding future safety risks. SafeMCP utilizes an internal world model for look-ahead reasoning to implement a two-tier defense: proactive tool filtering to constrain hazardous power expansion and immediate intervention as a fail-safe. To train SafeMCP, we introduce a three-stage pipeline comprising environmental dynamic grounding, safe policy initialization, and reinforcement learning (RL) with dual verifiable rewards. Experiments on PowerSeeking Bench, ToolEmu, and AgentHarm show that SafeMCP achieves a safe equilibrium, effectively mitigating risks while preserving agent utility.