Fuzzing-based simulation testing has become a fundamental technique for assessing the safety of autonomous driving systems (ADS). It operates by iteratively mutating simulation scenario configurations, scheduling scenario execution, and monitoring ADS-involved accidents. However, existing ADS fuzzers commonly rely on simplistic criticality metrics (e.g., inter-vehicle distance) for prioritizing critical scenarios during fuzzing, and lack deterministic guidance about how these heuristic-based critical scenarios should be further mutated to finally induce ADS-responsible accidents. Therefore, these existing fuzzers would inevitably miss truly critical driving scenarios or report various non-ADS-responsible accidents. To address these limitations, our key insight hints that EGO-to-NPC interactions (i.e., those recorded during the execution of a given scenario) offer comprehensive spatial-temporal information for reliable selection of critical scenarios and deterministic scenario mutation. Following this insight, we propose ExplorIt, a simulation-based ADS fuzzer enhanced with systematic formalization of interaction behaviors. Specifically, ExplorIt formalizes the runtime EGO-to-NPC interactions through drivable area estimation. That is, vehicles that share overlapped driving areas are considered to have interactive relationships. Under this modeling, ExplorIt can then deterministically mutate scenarios to curate more critical interactions by making EGO and NPC head for shared drivable areas. Extensive experiments on Apollo 8.0 demonstrate ExplorIt’s effectiveness, revealing 6.7 times more unique ADS-responsible accidents than baseline tools (i.e., DriveFuzz, SAMOTA, and AutoFuzz). Moreover, 83.2% of the reported accidents are ADS-responsible, compared to just 16.8% with baseline tools.
Bufan Gao, Zongan Huang, Jiarun Dai et al.· ACM Transactions on Software...· 0 citations
The Model Context Protocol (MCP) has rapidly established itself as a standard interface for enabling LLM-based agents to interact with external tools and services. As MCP servers are increasingly entrusted with security-sensitive operations, understanding their real-world risks has become critical. In practice, due to the absence of large-scale runtime MCP servers, such understanding largely relies on security scanners applied to a small number of cases, yet the reliability of these assessments remains unclear. In this study, we revisit how MCP security is measured. We present MCPZoo, the largest collection of MCP servers for dynamic analysis to date. MCPZoo is constructed through a multi-agent framework for transforming in-the-wild static repositories into dynamic services. The framework emulates how human experts build, diagnose, and iteratively repair deployment and runtime defects by combining environment inference with feedback-driven refinement. To ensure practical interactivity at runtime, the servers are validated via real protocol interactions. As a result, MCPZoo contains 64,611 unique MCP servers (113,927 in total), with more than 37,288 supporting dynamic analysis. Leveraging MCPZoo, we conduct the first ecosystem-scale measurement of MCP servers and the scanners that analyze them. While existing scanners report that 96.89% of servers are risky, we find that these signals are unreliable. In particular, manual validation shows that less than 50% of sampled alerts are true positives, and scanner outputs exhibit clear inconsistency across scanners. Overall, MCPZoo enables large-scale, reproducible measurement of MCP server security and exposes limitations of current scanning practices. We further release a public query interface to support practical risk assessment of MCP servers.
Pei Chen, Baichao An, Mengying Wu et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
