PP083: A CISO’s Perspective on Model Context Protocol (MCP)

今天的《数据包守护者》由Meter赞助播出。

Packet Protector is sponsored today by Meter.

Meter提供从有线到无线再到蜂窝网络的全栈网络基础设施，一个集成解决方案就能覆盖从分支办公室、仓库、大型园区到数据中心的各种规模。

Meter delivers full stack networking infrastructure from wired to wireless to cellular in a single integrated solution that scales from branch offices, warehouses, and large campuses to data centers.

现在就去meter.com/packetprotector预约演示吧。

Go to meter.com/packetprotector to book a demo now.

就是meter.com/packetprotector，预约演示。

That's meter.com/packetprotector to book a demo.

大家好，欢迎收听本期《数据包守护者》，这是一档探讨网络与安全交汇点的播客。

Hey, everybody, and welcome to this episode of Packet Protector, the podcast at the intersection of networking and security.

我是主持人Jennifer JJ Manila，旁边是我的搭档Drew Connery Murray。

I'm Jennifer JJ Manila here with my cohost Drew Connery Murray.

今天，我们邀请到了Pendo的首席信息安全官Chuck Kessler，如果你要查他的话，就是Pendo点I O。

Today, we're joined by Chuck Kessler, who's CISO at Pendo, and that's Pendo dot I o if you're looking him up.

本期节目不是赞助内容。

This is not a sponsored episode.

这是我们“问CISO”系列的一期。

This is one of our ask a CISO series.

作为安全负责人，Chuck对新技术如模型上下文协议（MCP）如何重塑企业连接AI系统与日常使用的工具和数据的方式，有着第一手的观察。

But as a security leader, Chuck has a front row seat on how new technologies like Model Context Protocol or MCP are reshaping the way enterprises connect AI systems with the tools and data that they use every day.

所以我们要聊聊为什么Pendo采用MCP，他们内部怎么用，以及这对企业安全自动化和风险管理的未来意味着什么。

So we're gonna talk about why Pindo adopted MCP, how they're using it internally, and what it means for the future of enterprise security automation and then also the risk management.

好的，Chuck，谢谢你来做客。

Well, Chuck, thank you for being here.

我想我们不如先打个基础。

And I guess let's just maybe set some groundwork.

什么是智能体AI？

What is Agentic AI?

因为我最近听到很多关于它的讨论。

Because I'm hearing a lot about it.

我知道我们的听众也经常听到。

I know our listeners are hearing a lot about it.

对你来说，这意味着什么？

What does it mean to you?

所以，我觉得“智能体AI”这个词，大家都在努力理解它，而且每个人对它的定义可能都有点不一样。

So, Genetic AI, I believe is a term everybody is trying to wrap their brains around and everybody sort of has maybe a slightly different definition of what it means for them at this point.

在我看来，它就像是一个能在AI基础设施里、在LLM内部运行的任务，去执行任务，做很多事情，而不只是回答一个问题。它会采取一系列行动，并根据前一个答案的结果来调整接下来的行动。

From my perspective, I'm looking at it as it's like a job that can run inside of, an AI infrastructure inside of an LLM to go and execute tasks to actually do multiple things as opposed to just answering one question to take a series of actions and have it take different actions based on the results of a previous answer.

所以，是的，就像名字暗示的那样，它是一个代理，代表你去行动。

So yeah, as the name would imply, it's an agent that is something that is acting on your behalf.

你能分享一个你觉得方便的例子吗？

Could you give an example that you feel comfortable sharing?

当然可以。

Sure.

我觉得最典型的例子，大家经常提到的，就是那种旅行预订工具。你告诉你的AI工具，比如你常用的那个云聊天工具，说：“嘿，我想明年六月去马德里旅行。”

So I think the prototypical example I hear most people talking about are the, you know, kind of the travel booking tools where you tell your AI tool, your tool of choice, cloud chat, hey, I would like to go book a trip to Madrid next June.

然后它就会去查，然后说：“好的，你通常喜欢在这个时间段出行。”

And it goes and figures out, okay, you know, hey, you typically like to travel this time of day.

这些是你喜欢的航空公司。

These are the airlines you like.

这些是你有的常旅客计划。

These are the frequent flyer programs you have.

我会去查一下哪些是最适合你的选项。

I'm going to go and check what seems to be the best options for those.

然后有些情况下，我觉得智能体AI可以直接采取行动，或者它会回来说，你看，我找到了这些选项，你想让我获取更多信息吗？

And then in some cases, I think AgenTic AI can either just directly take an action at that point, or it might come back and say, you know, look, I found these options, you know, would you like me to get some more information?

你想选其中一个吗？

Would you like to pick one of these?

所以人可以参与其中。

So the human and the loop can be part of that.

或者你可以直接告诉它，算了，直接订吧。

Or you could just tell it, you know what, just go book it.

我个人不会这么做，但确实是个选项，它可以去订机票，然后继续下一步，比如看看哪些酒店最好。

I personally would not do that, but certainly an option that it could then go book the flight and then take that next step of, okay, well, what are the best hotels?

同样，你通常喜欢住什么样的酒店？

And again, same thing, what are the hotels you typically like to stay at?

你在哪些地方有积分？

Where do you have program points?

然后它会去查看最佳选择是什么。

And it then goes and looks to see what the best options are.

同样，它可以直接采取行动，或者回来问你更多信息，然后再决定下一步怎么做。

And again, could take an action directly or it could come back and ask you for further information before it makes a decision as to what to do next.

这显然是一个现实世界的例子，涉及人类活动。

So that's obviously a real world example, you know, with a human activity.

如果从安全角度来看，或者类似的情况，你可以用类似的方式看待它，比如你刚收到一个警报，而你有一些操作手册，可能想根据这些手册采取行动。

If you think about it in a security context or something of that nature, you could look at it, you know, in a very similar fashion, you're dealing with some alert that has just come in and you have run books that you might want to take an action based on.

所以你的大语言模型可以学习这些操作手册，并决定，嗯，我可以采取一系列行动。

So your LLM can learn that run book and decide, you know, here's a set of actions I could take.

同样的思路，它可以自动替你采取行动，或者回来问你，你觉得我该怎么做？

Again, same sort of idea that it could either automatically take an action on your behalf or come back and ask you, what do you think I should do?

你看，这就是我发现的情况。

You know, this is what I found.

我需要你这位人类给我一些输入，告诉我接下来该怎么做。

I need some input from you human to tell me what to do next.

所以从这个角度来说很灵活。我觉得大多数人理想的状态是，对智能体足够信任，让它真正替你去采取行动。

So flexible from that standpoint, you know, I think in the state that most people would like to get to is to be comfortable enough with the agent that it's actually going to go take the action on your behalf.

但是，是的，我觉得我们大多数人还是需要一段时间才能达到愿意完全放手的地步。

But, yeah, most of us are just gonna take us a while, I think, to get to that point where we're willing to turn the reins over completely.

我肯定还没到那一步，因为就在我们打这个电话之前，我正想让ChatGPT帮我查下个月去欧洲的一些航班，那些航班有点绕，我都没法让它搞定。

I'm definitely not there because I can't I've just before we got on this call, I was trying to get chat GPT to to help me with some flights for next month in Europe that are a little convoluted, and I can't even massage that out of it.

但是，是的。

But Yeah.

我一直保留的一件事是，我肯定不会，比如，直接让它帮我订那些东西，在

One of the things I I keep so I'm definitely not gonna, like, tell just tell the book stuff for me at

这个阶段。

this point.

现在我知道一些组织内部更定制化的东西，比如你们那边的情况。

Now I know some of the stuff that's more tuned inside of organizations like, you know, where you are.

你们做了很多工作，把它变成了自己的东西。

You you guys do a lot of stuff to make it your own thing.

它不只是运行一个公开的ChatGPT实例。

It's not just, you know, a public chat GPT instance running.

我一直听到的一个事情是，智能体AI——你知道，就在我们开始录音之前，我跟Chuck和Drew说，我觉得自己像个AI小白，完全是个新手，因为我还在努力理解这些术语。

One of the things that I keep hearing is that, you know, agentic AI I'm you know, I was just before we started recording telling Chuck and and Drew, I feel like a like an AI goober, like a total new because I'm still trying to wrap my head around the terminology.

每次我觉得自己懂了点什么，就会有新东西冒出来。

Every time I think I understand something, some other thing comes out.

然后当我问那个新东西的定义时，我就会说，但这不就是之前那个东西在做的吗？

And then when I asked for definition of that, I'm like, but isn't that what we were what that thing was doing before?

然后答案是，不是。

And the answer is no.

我就是错了。

I'm just wrong.

但我一直听到的一个说法是，代理式AI的一个区别就是它们开始变得更专注于自己的任务。

But one thing that I keep hearing is that agentic AI, that one of the differences is they start to be more specialized in their in their task.

所以几周前，德鲁提到了模型上下文协议，我们一会儿就会讲到这个。

And so weeks ago at this point, you know, Drew brought up Model Context Protocol, which is what we're gonna get to in a little bit.

所以对我来说，看着这个，感觉有点吓人，因为我在想，你是一家公司的首席信息安全官，这家公司做的软件会被其他公司集成到他们的产品里使用。

So to me watching this, it's it seems like a little bit scary because I'm assuming I mean, you're you're a CISO of a company who makes software that other companies, you know, consume and use inside of their product.

所以安全对你来说是个大问题，不只是因为你自己的东西，还因为你还要处理别人的东西。

So security is a huge issue for you, not just because it's your own stuff, but you have other people's stuff as well.

对。

Mhmm.

而且我觉得这就像信息黑洞一样，信息进进出出。

And and I have this kind of like it just feels like black holes of information going in and out.

所以当你想到代理式AI以及你如何使用这些东西时，作为首席信息安全官，你面临哪些安全问题？

And so when you think about like agentic AI and how you're using these things, what are some of the security issues that you're dealing with as a CISO?

是的，我觉得最大的问题，特别是关于代理式AI，目前让我担心的是认证模型，因为通常，当我们去——我们一会儿会讨论MCP——我觉得这也适用。

Yeah, mean, I think the biggest one, particularly with respect to agentic AI that concerns me at the moment is the authentication model because typically, you know, when we're going to, again, we're going to talk about MCP's in a minute, I think this applies there as well.

不管怎样，那个代理都必须以你的身份来运作。

Somehow or another that agent has to operate under your identity.

比如，OpenAI发布了他们的ChatGPT代理。

For example, OpenAI released their ChatGPT agents.

可能它确实有个正式的名字。

There might actually be an actual name for it.

我记得大概是一个月前发布的，可能叫代理模式之类的。

I think it just might be agent mode or something like that, they released that, you know, month or so ago.

而且，你知道，因为Pindo的指导方针是我们要拥抱AI。

And, you know, because our directive at Pindo is like, we need to embrace AI.

好的。

Okay.

我们会启用这个功能。

You know, we're going turn this on.

我们会搞清楚它是怎么运作的。

We're going to figure out how it works.

在做的过程中我们发现，好吧，是的，它基本上是在提示你输入认证凭据，包括多因素认证，来让你登录像Salesforce这样的应用，或者让代理登录Salesforce。

And in doing that we found, okay, yeah, it basically is prompting you for your authentication credentials, including your MFA to log you into an application like say Salesforce or log the agent into Salesforce.

所以，这有点吓人。

So like, okay, that can be kind of scary.

它到底是怎么做到的？

How is it actually doing that?

基本上，他们是在启动一些小虚拟机来捕获所有这些信息。

Basically, they're standing up little VMs that capture all of that.

再说一次，我可能会把技术细节讲得乱七八糟。

And again, I'm like, I'm going to butcher the technical details.

向OpenAI道歉。

My apologies to OpenAI.

我可能没有把你们讲得足够好。

I may not be doing you justice here.

你知道，当会话结束时，这一切都会消失。

You know, it all goes away when the session is done.

但你想一想，这基本上就是在模拟那个认证过程，而这个过程通常背后是有真人的。显然，这种事情出错的机会很多。

But you know, if you kind of think about that, you're essentially spoofing that authentication process, which typically has had a human behind it in the Obviously it seems like there's a lot of opportunities for something like that to go wrong.

所以我觉得这是最让我担心的一点。

So I think that's the biggest thing that concerns me.

我知道我们经常讨论提示注入之类的问题。

I know we talk a lot about prompt injections and things of that nature.

当然，那些也是潜在的担忧。

I mean, are certainly potential concerns as well.

我们看到过一些有趣的、半假设性的例子，但我觉得在现实世界中，我们还没有真正看到太多真正有影响的提示注入攻击。

We see, there have been some interesting sort of quasi hypothetical instances of that where, you know, I think in the real world, we're not, we haven't really seen too much in the way of true prompt injection attacks that really are meaningful.

我不是说它们不存在，但对我来说，它似乎比认证模型可能失败的风险要小，尤其是当我们开始谈论代理型AI的时候。

I'm not saying that they aren't out there, but to me it seems like less of a risk than something like, you know, how this authentication model could fail, especially once we start talking about agentic AI.

而且，显然每个人都担心数据泄露，以及他们的信息被用来训练全球模型。

And that, you know, obviously everybody's concerned about data leakage in their information being used to train global models.

我觉得我们大多数使用ChatGPT或Cloud这类企业版的人，那些全球训练开关默认是关掉的。

I think most of us that are using enterprise options for things like ChatGPT or Cloud, those global training switches are kind of turned off by default.

如果你不用企业版，也有选项可以手动关掉这个功能。

And if you're not using the enterprise ones, are options for you to go and turn it off manually on the enterprise side.

如果你不这么做，用的是消费者版本，那你就得靠用户自己去关，你知道那会是什么结果。

If you're not doing that, you're if you're using the consumer version, then you have to build upon your users to go do that, which you know how that works out.

所以我们倾向于投资企业版，因为这样在安全和隐私方面能走得更远一些。

Which is why we tend to go ahead and invest in the enterprise versions because that tends to get you a little bit further down the road in terms of security and privacy.

有一点我要提一下，我并不是在批评OpenAI，实际上他们一直是我们很好的合作伙伴。

One thing I will mention, again, not at all throwing OpenAI under the bus actually, because they've been a great partner to us.

但他们跟我解释过消费者产品和企业产品的区别，消费者产品基本上是企业产品的试验场。

But one of the things they explained to me and their differences between consumer products and the enterprise products is the consumer product is basically the training ground for the enterprise product.

所以，你知道，他们在消费者版本中推出新功能的速度更快。

So, you know, they roll things out more quickly in the consumer version.

这些功能在安全、隐私和合规方面还没有完全成熟，基本上他们是在用消费者用户来做一些测试。

Those things are not fully baked from a security privacy compliance perspective until essentially they're using the consumer role to do some testing.

所以，最新模型进入企业版需要更长的过渡期，因为他们要先在消费者产品中学习，看看哪些地方可能出问题，然后再部署。

And so there's a slower roll up roll up period to get those latest models into the enterprise version because again, they're learning their consumer product, the things that can go wrong before they they deploy this.

确实，这说得通。

I mean, that makes sense.

我也这么觉得。

I would expect that.

我的意思是，就算我们作为消费者付点小钱，我也完全预料到，我放进去的东西，它吐出来的结果不一定准确。

I mean, even if we're paying some nominal fee as a consumer, I fully expect anything I I put in there to not necessarily be be accurate when it gets spit back out at me.

嗯，关于这个，我遇到的有趣的拉锯战是，我们确实有些人特别热衷于追求最新最好的功能，他们会说，嘿，我能不能直接用消费者版，那个每月200美元的版本，因为它能比企业版早两周拿到这个功能？

Well, the the interesting kind of push and pull on that that I get is that we do have some people that are so gung ho to get the latest and greatest features that like, Hey, can I just use the consumer version, the $200 a month per version because it's going to get this thing two weeks before the enterprise version?

对，我理解。

Yeah, I understand.

也许我们可以用某种沙盒的方式，针对某些事情这么做，这样就能让一小部分人更快地直接接触到那些功能。

And maybe there's some kind of sandbox ways we can do that for certain things just so we can get a small number of people, you know, kind of direct access to those things more quickly.

我觉得查克就是个典型的CISO，他会想办法找到可行的方案，而不是直接说不行，忍两周吧。

I see Chuck is a perfect example of the type of CISO that's gonna figure out how to get to the yes, instead of just no suck it up for two weeks.

是的。

Yeah.

我有时候确实会说，嘿。

I mean, I I do sometimes say, hey.

我们，它要两周后才来。

We it's coming two weeks.

他们告诉我需要两周，所以我们可以等这两周。

They told me it's two weeks, so we can we can wait the two weeks.

对。

Yeah.

我们可以

We can

如果真有特别重要的理由，那我们会另想办法，但通常不会这么做。

two And if there's a really compelling reason, you know, we'll go and find some other way, but to do it, no.

是的。

Yep.

所以我想问一个关于身份认证的问题，因为我知道我听过一些演示，也听到一些风声，尤其是在云环境中使用身份作为微隔离的做法。

So I have a question around some of the authentication identity because I know I've heard, you know, some, you know, seen some presentations and heard some rumblings around, you know, especially in the cloud using identity as micro segmentation.

比如说，把每个身份能做的事情缩小到基本上只有一个功能。

So, like, you know, down scoping what any identity can do to the to the point that it only basically has one function.

那在智能体AI里，有没有机会也这么做？

Do is there opportunity to do that with agentic AI?

我们现在是不是就在做这个？

Is that kind of what we're doing?

它们有没有自己的身份，而且这个身份被限制在它们需要做的事情上，还是说我们还没到那一步？

Do they have their own identity that's down scoped to what they need to do, or are we just not there yet?

对，我觉得我们还没到那一步。

Yeah, I mean, I don't think we're there yet.

到目前为止，我看到的大部分情况是，用户把自己的身份交给智能体，让它在用户的上下文里操作。

Most of what I've seen far so far would be, you know, the user providing their identity to the agent to operate under the context of that user.

当然，你也可以把它扩展到服务账户之类的。

I mean, you could obviously extend that to like a service account or something like that.

而且，如果你考虑在产品里建一个MCP服务器，那可能是个更可行的方式，在某些情况下，这确实比用用户身份更可行。

And when you think about building something that might be an MCP server inside of your product, that might be a more viable way to do things where it actually is absolutely more viable ways to do things in certain cases than kind of using the user identity.

不过，我觉得确实有机会。

But yeah, I mean, I do think there's an opportunity there.

我够不够聪明，能告诉你具体是什么样子？

Am I smart enough to tell you exactly what it looks like?

不，我不够。

No, I'm not.

嗯，我很好奇，你提到的那个ChatGPT例子，你给它你的认证凭据或授权凭据，它替你登录，那它是不是也会继承你所有的权限？

Well, I'm curious, this ChatGPT example you mentioned where you give it your authentication credentials or your authorization credentials and it logs in sort of on your behalf, does it also inherit sort of, like, all of your rights?

比如说，如果我有权限删除整个数据库，那这个代理是不是也有这个权限？

Like, you know, if, you know, I have the permissions if I needed to to delete this entire database, like, does the agent have that?

它是不是就得到你所有能得到的东西？

Like, it just gets everything you get?

对。

Yeah.

是的，它会，因为再说回我的Salesforce例子，因为那件事在启用代理模式时确实出现过，销售人员想用它来自动化他们在Salesforce上的一些工作。

I mean, it would because again, I'm going back to my Salesforce example that because actually that was something that came up when agent mode, we turned on the agent mode and salespeople that wanted to use it to automate some things that they were working on in Salesforce.

而且这其实可能是个很好的用例。

And it's actually probably a great use case.

不过是的，它会以那个用户的身份来操作。

But yeah, it's going to operate as that user.

不过，这些用户通常不完全是Salesforce管理员。

Now, those users are not typically full on Salesforce admin.

所以，即使是那些管理员，他们也会用不同的身份来做这件事。

So, and even the ones that are, are, you know, going to be using separate identities to do that.

希望不是传给代理模式的那个身份，但目前的模式就是这样，它会以你的身份操作。好处是它只能访问你有权限看到的东西，而不是像那种更通用的服务账户，权限更广，那样的话，你可能会访问到一些你本来没有权限、不应该访问的东西。

Hopefully not the one that you're passing to the agent mode, but currently that is the model right now is that it will operate as you, you know, the plus side of that is it's only going to give you access to the things you have access to see versus if it were kind of a more general service account, which had broader access, then, you know, you could potentially get access to things that you didn't have access, weren't supposed to have access to.

所以，是的，这就是目前的模式。

So, yeah, that is the model right now.

你还提到了那个虚拟元素，有点像在启动一个虚拟机，虽然这个说法可能不太准确。

You also mentioned like this virtual element that it's sort of, spinning up a we use the example of a VM if even though that's not maybe technically correct.

它有时间限制吗？

Is there a time limit on it?

它拿着你的凭证能用多久？

Like how long does it have your credentials that it can use to do things?

这个问题问得好。

That is a great question.

我不太确定答案，但我的理解是，时间限制基本上就是它执行这个特定任务的时间。

I don't know the answer to perception is that essentially the time limit is the limit of when it's doing this particular job.

也就是说，针对那个特定会话，它会在会话结束时把所有东西都清理掉。

So for that particular session, so it's going to tear all that stuff down at the end of the session.

我得回去查一下笔记才能百分百确认，但我觉得它不是持久保存的。

I have to go back and look at my notes to 100% verify that, but I don't think it's persistent.

所以它不会在那里挂个三十天之类的。

So it's not hanging out there for thirty days or something like that.

好的，所以就像虚拟机一样，一旦会话结束，它就会销毁那些凭证。

Okay, so like a VM potentially, once the session has ended, it's blowing away those credentials.

它不会把它们存在任何地方。

It's not storing them anywhere.

所以你不用担心你的凭据会藏在某个模型里。

So you don't have to worry about your credentials lurking somewhere in a model.

这正是我问的那个问题。

That was the specific question I asked.

关键就是，你们到底有没有把那些凭据缓存到某个地方？

The fact was, are you actually caching these credentials someplace?

他们告诉我没有。

And they told me no.

比如说，你输入的密码，不会被存储。

So for example, that password that you're typing in, it's not being stored.

它只是用来做身份验证，获取OAuth令牌。

It's simply being used to actually do the authentication to get the OAuth token.

所以它存储的是会话的OAuth令牌，而不是你的密码。

So it's storing the OAuth token for the session, but it's not storing your password.

企业用户能自己验证这一点吗？还是说我们现在只能选择相信他们说的？

Can a user enterprise validate that somehow or are we just kind of trusting what we're being told because we have to at this point?

目前来说，是的。

At this point, yes.

我是信任他们的。

I'm trusting.

我也可以再深入调查一下。

I could dig deeper.

我相信他们会很乐意让我联系一位工程师，他们会详细解释并展示他们具体是怎么做的。

I'm sure they would be happy to connect me with an engineer that would talk me through and show me exactly what they're doing.

OpenAI 显然，你知道，背后有大量资源支持。

OpenAI is obviously, you know, has a lot of resources behind it.

所以我相信他们考虑到了这些问题，并且在渗透测试和合规性方面做了适当的工作，确保他们不会对这些凭据做出什么愚蠢的事情。

So I'm trusting that they are thinking through those things and doing the appropriate things from a penetration testing perspective and a compliance perspective to ensure they're not doing something stupid with those credentials.

希望如此。

We hope.

所以

So

你觉得这对首席信息安全官以及所有关注安全的人来说，在理解和管控风险方面，是不是完全进入了代理式人工智能这个全新的领域？

do you feel like this is entirely new to this agentic AI space is entirely new territory for CISOs and security minded folks in terms of understanding and managing risk?

还是说其实……

Or is it look.

因为你提到你最担心的是身份认证和授权问题，而这块我们早就一直在处理了。

Because you said your chief concern is authentication and authorization, and we've been dealing with that forever.

所以这到底只是在新场景下面临同样的风险，还是说我们其实在应对一些全新的东西？

So is it just sort of like same risks in a new context or is this are we dealing with something new?

我觉得风险大体上还是那些，只是换了个新场景，而且发展速度极快，很容易迅速扩展到一些我们原本没预料到的领域。

I think it's mostly the same risks in a new context, but one that is moving very quickly and has a lot of opportunity for quick expansion into territories that maybe we weren't expecting.

我认为AI本身这种非确定性的特点，让安全测试里那些常规操作变得难多了。

I think the whole non deterministic nature of AI in general just makes it so, you know, the typical things that we would do from a security testing perspective are harder.

通常我们会针对特定情况做测试，确保它要么不产生这类输出，要么确实产生这类输出。

You know, we typically think we want to test for something and ensure we don't get this type of output or we do get this type of output.

但当输出结果是非确定的时候，想做到这一点真的很难。

It's really hard to do that when the output is non deterministic.

所以，是的，这就是我认为在AI方面存在新风险的地方，因为做我们安全领域习惯的那种传统测试变得更难了。

So yeah, that's where I think it is a new risk just in general with respect to AI, because it is harder to do that more traditional type of testing that we're used to in the security world.

举个例子，我试图理解代理式AI的用例，还有我们即将接触到的模型上下文协议，据我理解，就是那些AI实体以结构化方式互相交流，但不需要我们手动通过API来集成。

And the example, so I'm trying to wrap my head around the use cases for both agentic AI, but also I guess where we're gonna be getting to, which is like Model Context Protocol, which my understanding is kind of those agent those AI entities talking to each other in a structured way, but without the structure of us kind of integrating via, like, APIs manually.

这样它们就能互相协调并处理事情，基本上，而不是我们告诉它们如何精确地协调。

So that they kind of they coordinate with each other and handle it, basically, instead of us telling them how to exactly coordinate with each other.

你举的例子就像是，Salesforce用户和某个在CRM和邮件提取方面有权限的人，或者我只是随便说说。

So the example you gave was kinda like, you know, the the Salesforce user and and somebody who has, you know, certain rights between, like, CRM and maybe scraping some stuff out of their email or I'm just making stuff up.

对。

Mhmm.

对吧？

Right?

但有没有更核心的用例，比如，在你们的情况下，你们开发软件。

But are there also use cases of these more central to I mean, like, in your case, you know, you guys create software.

这种AI是不是也在组织内部更深处用于行动或开发，或者某种不是基于用户，而是更系统性的东西？

Is this also being used kind of further inside of the organization for for actions or development or or something using AI that's not kind of user based, that's more systemic?

对。

Yeah.

我可以稍微聊聊我们是怎么在自己的产品里构建这个的，因为我觉得同样的模式也适用于市面上很多不同的工具。

I can talk a little bit about how we're building this in our product because, and I think this, the same model can apply across a lot of different tools that are out there.

比如说，Atlassian 就有一个 MCP 产品，一个 MCP 服务器，本质上它就像是一个连接他们 API 的 LLM USB 总线。我这么说，正好可以接回我们之前聊的 MCP 话题。

Like, for example, Atlassian has, and just going to kind of bridge into the MCP discussion, I think with this, because I think this comes So into for example, Atlassian has an MCP product out there, an MCP server, and essentially what it is, is a LLM USB bus, if you will, to their APIs.

所以我们在自己的产品里也在做类似的事情。

So we're building the same sort of thing inside of our product.

我们有个叫“聚合”的功能，本质上就是一种查询语言，你可以用它来问，比如“告诉我过去三十天我网站访客的画像”，这就是我们做的产品分析。

We have something called aggregations, which are essentially kind of a query language to go and say, you know, tell me this profile of my visitors for the last thirty days in my website visitors, that's what we do, product analytics.

这些聚合查询有点像一种特殊的“秘制酱料”语言。

Those aggregations are kind of a special sauce language.

人们确实能学会它，然后自己写 API 查询来和它交互。

People do learn it and they can do their own API queries and interact with it.

但是 LLM 对这些东西的工作原理完全不了解。

But the LLM has no idea how any of that stuff works.

所以这就是MCP发挥作用的地方，MCP了解我们的聚合功能是如何工作的，也知道如何与其他可能向它提问的LLM和其他MCP进行交流。

So that's where the MCP has come into play, is the MCP understands how our aggregations work, and it understands how to talk to other LLMs and other MCPs that might be asking it for a particular question.

所以它能接收那个问题，然后说，好的，你需要从那个特定的数据库获取这些信息，然后基本上把这些信息打包，返回给那个LLM，然后LLM再施展AI魔法，回答你想要的问题。

So it can take that that question and say, Okay, you know, you need to go get this information from this particular database and then basically package that up and provide it back to the LLM who is then going to essentially do the AI magic on it and answer the question that you wanted.

但别忘了，LLM是基于截止日期之前的信息训练的，比如ChatGPT 5，我记得截止日期差不多是一年前，2024年9月30日。

But just kind of remembering that LLMs are trained on information that, for example, ChatGPT five, I think the cutoff date was almost a year ago, 09/30/2024, I believe.

所以从那之后发生的事情，它一概不知。

So it doesn't know anything that's happened since then.

所以如果它要回答基于那之后发生的事情的问题，你就得给它喂它需要的信息，或者你得能连接它，告诉它去访问某个网站之类的，去了解这些信息，它也可以抓取网页什么的。

So if it's going to answer a question based on anything that's happened since then, you have to kind of feed it the information that it needs, or you have to be able to connect it and say, hey, go access this website or whatever to learn about this and, you know, can scrape and things like that.

而MCP基本上就是我们提供这些信息，特别是那些更新的信息给LLM的方式，但它是专门定制的。

But MCP is basically our way to essentially provide that information, that kind of more up to date information back to the LLM, but it is specialized.

它知道怎么和我们的产品对话。

So it knows how to talk to our product.

Atlassian的MCP知道怎么和Jira、Confluence以及其他Atlassian产品对话，然后把那些信息打包，再交给LLM，这样LLM就能施展AI魔法，基于Atlassian云里的所有信息，给你你需要的答案。

The Atlassian MCP knows how to talk to Jira and Confluence and all the other Atlassian products and package that information back up and give it back to an LLM so the LLM can do its AI magic and give you the answer that you need based on all that information that sits in the Atlassian cloud.

对。

So Yeah.

MCP基本上是围绕客户端-服务器模型构建的。在你的例子里，让我看看我理解得对不对——你基本上有一个LLM充当客户端，然后你说，我需要从我们的Atlassian实例中获取一些信息。

MCP is essentially built around a client server model where, in your example, let me see if I've got this right, you essentially have an LLM that's acting as a client, and you're saying, I need to get some information out of our Atlassian instance.

与其我自己去翻找，不如让我的MCP客户端去从Atlassian获取这些数据。

And instead of me digging around in it or whatever, I'm gonna ask my MCP client, go get this stuff from Atlassian.

我的客户端通过MCP协议与Atlassian服务器通信。

My client uses the MCP protocol to talk to the Atlassian server.

Atlassian已经设置好了这个服务器，能够在后端找到所有需要的数据。

Atlassian has set up this server to be able to go and find all the stuff on the back end.

它找到这些数据后，再传回给我的客户端，整个过程都是通过自然语言进行的，因为我只是在客户端用自然语言发出指令。

It finds that stuff and delivers it back to my client, and it's all happening via natural language because I'm just using natural language prompts on my client end.

对。

Yeah.

我觉得这个总结相当不错。

I mean, that's I think that's a pretty good summary.

MCP可以运行在你的笔记本电脑或台式机上，也可以运行在云端。

MCP's can either run locally on your laptop, desktop, or they can run-in the cloud.

实际上，最早的MCP更多是运行在本地设备上的。

So actually the very first MCPs were more ones that would run on your local device.

基本上，你可能会运行一个云桌面。

And essentially you might be running like a cloud desktop.

我觉得Anthropic是最早做MCP的。

Anthropic, I think was the first that did MCP.

所以它最初就是设计来配合云端使用的。

And so it was designed to work with cloud.

基本上，它是一个运行在你笔记本电脑上的本地服务器，云桌面会跟它通信。

Essentially it was a local server running on your laptop that the cloud desktop would talk to.

然后，你给这个本地服务器提供信息，告诉它如何查询其他各种不同的东西。

And then you would essentially give that local server information on how to go and query all these other different things.

这就是你会去拉取开源代码的地方，这又是一件有点吓人的事情。

And that's where you would pull an open source code, which again, kind of a scary thing to do.

尤其是今年。

Especially this year.

没错。

Exactly.

把它接入你的本地MCP，然后它就会去执行任务，再把信息返回给云端桌面，云端桌面再把它反馈给云端的大语言模型，然后就这样完成操作。

Into your local MCP and it would then go and do the thing and then give the information back to cloud desktop, which would then feed that back into the cloud LLM and, you know, do it.

这又是AI的魔法。

It's again, it's AI magic.

另一种模式是MCP在云端运行，也就是远程运行。

The other model is the MCP runs in the cloud, it runs remotely.

所以像Atlassian MCP服务器就是这样部署的。

So that's where something like the Atlassian MCP server is out there.

你可以让你的桌面MCP服务器指向Atlassian MCP。

And so you can point your desktop MCP server at the Atlassian MCP.

你需要训练或指导你的本地MCP服务器如何与Atlassian通信，因为他们已经帮你做好了这些。

You have to train your local or instruct your local MCP server on how to talk to Atlassian because they've already built that for you.

所以，是的，这就是两种模式。

So yeah, those are the two models.

我可能有些技术细节说得不太准确，但据我理解，这就是两种部署方式：要么你把模型放在自己的笔记本电脑上，要么你通过第三方服务提供商提供的SaaS解决方案来访问云端模型。

Again, I might be butchering some of the technical details, but as I understand it, those are the kind of the two deployment models, either you're putting it locally on your laptop or you're accessing one that's provided by your third party service provider on your SaaS solution that sits out in the cloud.

而且，我们在Pendo做的就是这样一个版本，目前它只在我们自己的产品内部运行。

And again, that's what we're building at Pendo is a version of that, that currently it just works within our own product.

我们还没有对外公开，但这就是我们如何为产品添加AI功能，让它更像一个聊天模式。

We're not externally exposing it, but it's actually how we are adding AI capabilities to become more of a chat mode to our product itself.

但最终我们可能也会把它开放给外界。

But eventually we'll probably expose that to the world as well.

所以即使不对外公开，你仍然可能有一个MCP服务器，在产品内部帮助实现与数据聊天的功能。

So even if it's not exposed to the world, you know, you may still have an MCP server that's helping to facilitate kind of a chat with your data type function inside of a product itself.

它就在后台默默运行。

Just, you know, kind of sits behind the scenes.

所以，是的，有很多不同的部署方式。

So yeah, lots of different deployment models.

我忘了原来的问题是什么了，但我觉得跟这些工具很专业有关，它们确实很专业。

I forget what the original question was, but I think it had something to do with, you know, these things being specialized and they absolutely are.

这种专业化要么是供应商为你定制并交付，要么就是你把别人做的开源项目集成到自己的本地MCP服务器里。

And the specialization either happens by the vendor building it for you and providing it to you, or again, kind of pulling these open source things that people have built into your own local MCP server.

我们先插播一段赞助商Meter的广告。

Let's pause for a quick word from sponsor, Meter.

Meter为领先企业提供全栈网络服务，包括有线、无线和蜂窝网络。

Meter delivers full stack networking, wired, wireless, and cellular to leading enterprises.

这是一个集成的解决方案，所有东西都包含在内。

It's a single integrated solution with everything included.

真的是什么都有。

And I mean everything.

包括ISP采购、安全、路由器、交换机、无线接入点、防火墙、蜂窝网络、电源、DNS安全、VPN、SD-WAN，还有多站点工作流。

ISP procurement, security, routers, switches, wireless APs, firewalls, cellular, power, DNS security, VPN, SD WAN, and multisite workflows.

Meter自己设计硬件、编写固件，还开发了软件。

Meter has designed the hardware, written the firmware, and built the software.

这真的是一个完全集成的解决方案。

It's a truly integrated solution.

而且，Meter 和合作伙伴一起，负责设计、部署和管理你所在站点所需的一切，让你获得高性能、可靠且安全的连接。

And alongside their partners, Meter designs, deploys, and manages everything required at your site or sites so that you get performant, reliable, and secure connectivity.

如果你准备好获得快速、安全且可扩展的连接，而不需要管理多个供应商或工具的复杂性，那么是时候了解一下 Meter 了。

If you're ready for fast, secure, and scalable connectivity without the complexity of managing multiple providers or tools, it's time to check out Meter.

现在就去 meter.com/packetprotector 预约演示吧。

Go to meter.com/packetprotector to book a demo now.

就是 meter.com/packetprotector 预约演示。

That's meter.com/packetprotector to book a demo.

感谢 Meter 的赞助，现在回到播客。

Thanks to Meter for being a sponsor, and now back to the podcast.

如果我们有多个平台，每个都有自己的 MCP 服务器，比如你提到的 Atlassian 和内部的东西，那该怎么办？

What do we do if we have because you gave, you know, an example of, like, Atlassian and then stuff you're doing internally.

如果这些平台各自有 MCP 服务器，它们之间会互相通信吗？还是说它们之间会有语言模型？

If we have several platforms that each have their own MCP, let's say, server, do they talk to each other or are there LMs between those?

我觉得它们之间没有理由不能互相通信。

I mean, I don't think there's any reason they couldn't be talking to each other.

我倒是没见过实际例子，但回到我们之前聊的，如果一个代理要替你执行多个操作，那在这种场景下，MCP几乎肯定能派上用场，帮它搞清楚需要收集哪些数据，然后把它们整合到流程里。

I don't know if I've seen personally an example of where they're doing that, but I think if you go back to what we were talking about earlier with respect to an agent that's taking multiple actions on your behalf, almost certainly in those types of contexts, MCP could or should be involved in helping to facilitate figuring out all the different data that needs to be gathered and kind of brought into the process.

MCP是大家都能用的标准开放协议，还是目前只是生态里的一部分人在用？

An MCP a standard open protocol for everybody to use, or is this just parts of the ecosystem they're using at this point?

对。

Yeah.

这个嘛，我也不太清楚。

I mean, I don't know.

现在“标准”这个词挺有意思的。

Standard is kind of a interesting term these days.

就是……我不太确定。

It's I don't

据我所知，目前还没有像IATF或IEEE那样的官方机构来制定这个标准。

guess there's It's not there I don't to my knowledge, there is no, like, official body like the IATF or the I triple e

或者没有RFC。

or There's no RFC.

C。

C.

对。

Yeah.

MCP没有RFC。

There's no RFC for MCP.

就是Anthropic发布了它，然后说，嘿。

It's just Anthropic released it and said, hey.

我们在社区里做这个，它在GitHub上。

We're doing this in the community, and it's on GitHub.

人们有点

And people are sort of

而且每个人都可以使用它。

And everybody can use it.

对。

Yeah.

对。

Yeah.

对。

Yeah.

没错。

Exactly.

对。

Yeah.

这也是我的理解。

That's that's my understanding as well is that

那现在有没有其他类似的竞争版本？

Are are there competing versions of that out there?

有的。

There are.

对。

Yeah.

有

There

的。

are.

我不会说它们是竞争关系，但确实有其他协议在涌现。

I wouldn't say competing, but there are other protocols that are emerging.

比如，HAS有一个。

Like, has one.

谷歌发布了一两个，我记得是A2A和AP2。

Google has released a couple, I think, a two a and a p two.

我觉得IBM的是ACP。

I think IBM's is ACP.

它们的基本思路都差不多，都是想让智能体能够交换信息、互相交互，但有些协议，比如谷歌的AP2，更侧重于让你能代表用户进行支付和处理交易。

And they all have sort of the general idea is the same, to try to get agents to be able to exchange information and interact, but some have, like, the a p two one from Google is more about allowing it to run make payments and run transactions on your behalf.

其他的则或多或少涉及安全性和身份验证。

And others are have some like more or less, you know, security and authentication involved.

对。

Yeah.

对。

Yeah.

那个A2A是我最近一直在关注的一个。

That's a way is one that I've been looking at a little bit recently.

是的，我觉得这更符合代理之间对话的使用模式，就像A2A这个名字所暗示的那样。

And yes, I think that's more back to the use model of agents talking to agents as the A2A would imply in the name.

所以我觉得这是一个类似MCP的例子，它实际上是为了促进不同代理之间的交互而设计的。

So I think that's an example of, you know, something MCP like, which is really designed for facilitating interactions between different agents.

而MCP最初由Anthropic推出时，可能更偏向于那些云桌面用户，他们想把多个应用的信息整合到他们在云端做的事情中。

And MCP in its original incarnation from Anthropic was, I mean, maybe more geared towards that cloud desktop user that was trying to incorporate information from multiple applications into into something they were doing with cloud.

但他们开源了它，所以任何人都可以使用。

But they open sourced it so that anybody could make use of that.

所以我知道OpenAI和其他公司显然也在采用它。

So I know OpenAI and others are obviously adopting it as well.

我能看出来。

And I could see it.

我的意思是，就像我们有TCP，我们会和SSL等其他东西一起用，将来AgenTeq AI可能会运行多种协议，我猜。

I mean, just like we have TCP that we use in conjunction with SSL and other things, could be running multiple protocols for AgenTeq AI down the line, I assume.

对，没错。

Yeah, exactly.

我觉得，这些例子可能用得太多了，而且可能不完全准确。

I mean, I think that, again, I feel like some of these these examples are overused and may not be completely accurate.

但我听到的最常见的关于MCP的比喻之一，就是像USB连接一样。

But one of the most common ones I hear about what MCP is, is like a USB a USB connection.

USB。

USB.

是的。

Yeah.

你知道，显然可以有各种不同的东西，看起来像USB或者不像USB，或者就是USB。

You know, you can obviously have all sorts of different things that look like USB or not USB, you know, or USB.

而且我们可以有USB-A和USB-C，还有

And we can have USB A and USB C and

那些苹果的奇葩接口。

all of the stupid Apple connectors.

雷电接口。

Thunderbolt.

不太一样，然后，对，一直追溯到老式的并口和SCSI接口，对吧？

Doesn't quite And then, you know, yeah, all the way back to, you know, parallel ports and SCSI ports in the old days, right?

你知道，现在仍然有各种接口。

You know, there's still there's still connectors.

基本上，它们都是用来把数据从A点传到B点。

Basically, they're facilitating the transfer of data from point A to point B.

对，所以比如我们之前聊到的认证问题。

And yeah, so for example, we talked about authentication earlier.

认证并不是这个协议本身自带的功能。

Authentication is not something that's sort of natively part of that.

你知道，这是两端设备各自处理的事情。

You know, it's something that the two things on the other end are dealing with.

但这基本上只是一个传输数据的管道。

But this is just basically a pipe to facilitate the data transfer.

作为企业的CISO，你不必非得回答你日常工作相关的具体问题，除非你想说。

And is a CISO in an organization and and you don't have to answer this specific to, you know, to your day job unless you want to.

但是，CISO的角色是，你开始有开发团队在琢磨怎么把东西拼起来，怎么连接各个点。

But, you know, the CISO's role is you start to have, you know, development teams that are kind of figuring out how to stitch things together and connect, you know, the dots.

CISO的角色到底是什么？

What what is the CISO's role?

或者说，有没有安全架构师，或者开发团队，通常当公司把软件作为产品来开发时，谁来检查这些，决定组织采用和使用什么才是安全的？

Or is there is there a security architect or the development team typically when you have companies who who are producing, you know, software as a product, who's checking these things and making the decisions about what's safe for the organization to adopt and use?

对。

Yeah.

再说，这也不是一刀切的事，因为显然不是每个公司都大到能有专门的安全架构师。

Again, that's not gonna be a one size fits all because obviously not every organization is big enough to have, you know, security, you know, architects, so to speak.

但这并不意味着我们没有参与讨论的人。

But that doesn't mean that, you know, we don't have people that aren't involved in the conversations.

所以，是的，我的意思是，我们是怎么处理的，或者我认为大多数不是五万人大公司、没有上千人安全团队的公司是怎么处理的。

So yeah, mean, how we're approaching it or how I think most companies that are not, you know, 50,000 people and have security teams of thousands are approaching it.

从我的角度来看，我们必须自己理解技术，对吧？

From my perspective, we have to understand the technology ourselves, right?

那我们怎么做呢？

So how do we do that?

嗯，一部分是去读资料，看播客或者别的来学习。

Well, partially we go read things, you know, we watch podcasts or whatever to learn.

但我觉得我们学习最好的方式其实是亲手去操作技术，要么和开发团队一起做，要么自己动手搭一个。

But I think really the way we learn best is we actually put our hands on the technology and we do that either in conjunction with our developers that are building things or we go build our own.

我们在Pindo的安全团队就真的这么干过。

And we've actually done that in my security team at Pindo.

所以，你知道，我们夏天做的一个实习生项目，我们实际上建了一个MTP服务器，基本上是为了实现我之前举的一个例子，我们想用SOAR的方式，根据环境中不同工具的事件来自动化一些操作。

So, you know, an intern project that we did over the summer, we actually built an MTP server to facilitate essentially one of the examples I was giving earlier where we wanted to essentially help automate kind of in a SOAR way actions based on events from different tools in our environment.

所以，我们基本上建了一个MCP服务器，可以和Google Workspace以及SIEM平台Sumo Logic这类工具配合使用。

So, you know, we basically built an MCP server that could work in combination with things like Google Workspace and SIM platform, Sumo Logic.

你知道，我们取得了不错的进展。

You know, we make good progress.

是不是百分之百完美，比如，哇，这就能部署了？

Is it, you know, a 100% like, wow, this is, we're deploying it.

不是，我们还在继续完善，但这让我们学到了很多关于MCP如何工作的知识。

No, we're still working on it a little bit, but it's something that helped us learn a lot about how MCPs work.

所以当我们和公司其他部门合作，构建MCP，无论是产品里的，还是公司内部可能用于企业用途的MCP，我们对它们如何工作以及可能出问题的地方有了更深入的理解，对吧？

And so as we're working with the rest of our organization and building MCPs, both in our product, as well as other MCPs, potentially for corporate uses inside of the company, we have a much better understanding of how they work and how they can go wrong, right?

因为我们真的动手用了这项技术，自己尝试去解决一个问题。

Because we've actually put our hands on the technology and used it ourselves to try to solve a problem.

所以，总的来说，我对AI采取的方法就是拥抱这项技术，自己使用它，找到从中受益的方式，同时确保我们清楚它可能出问题的地方。

So that's the approach in general I've tried to take with AI is to to essentially embrace the technology and use it ourselves, find ways that we can get benefit from it, but also make sure we have a good understanding of how it can break.