secure-agentic-framework/saf-mcp

What it solves

SAF-MCP provides a structured framework for documenting and analyzing adversary behaviors in agentic systems, specifically those utilizing the Model Context Protocol (MCP). It addresses the need for a standardized way to identify, categorize, and mitigate security threats unique to AI agents, such as prompt injection, tool poisoning, and sandbox escapes.

How it works

The framework uses a system of atomic, permanent technique IDs to represent distinct adversary behaviors. These techniques are organized into "profiles" (e.g., MCP Profile, Code-Agent Profile, RAG and Memory Profile) to scope behaviors to specific domains without duplicating IDs. It aligns with the MITRE ATT&CK framework by mapping techniques to 14 adversary objectives (Tactics), such as Initial Access, Execution, and Persistence. The project provides a detailed catalog of techniques, each linked to specific mitigation strategies and detection rules.

Who it’s for

• Security Teams: To build threat models for agentic deployments.
• Developers: To identify and implement mitigations for the agents, models, and tools they operate.
• Compliance Officers: To map security controls to known threats via MITRE ATT&CK linkages.
• Red Teams: To use as a reference for security testing of MCP deployments.

Highlights

• Permanent Technique IDs: Ensures consistency even when entries are updated or deprecated.
• Profile-Based Scoping: Separates general agentic mechanisms from domain-specific ones like MCP.
• MITRE ATT&CK Alignment: Supports threat modeling and detection engineering through established security standards.
• Evidence-Led Releases: Requires traceable claims and tested detections for new techniques.
• Operational Coverage Registry: Includes a detection coverage matrix to track validation maturity and rule ownership.