ECC
ECC 安全与运维：控制 Hooks、MCP、Memory 与代理权限
覆盖提示注入、Shell 审批、MCP 端点、持久化记忆、密钥、日志和事件恢复。
你将学会
- Threat-model the ECC execution surface
- Constrain hooks, MCP, memory, and logs
- Run incident containment and clean recovery
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Skills, hooks, MCP, and memory form one executable attack surface.
- Use least privilege, approvals, allow-lists, idempotence, and redacted logs.
- Incident response must revoke secrets and prove clean uninstall before recovery.
Assume every layer can execute
ECC 的 skills、hooks、MCP 和 memory 共同构成可执行攻击面。使用最小权限、人工审批、域名白名单、幂等钩子和脱敏日志，并验证清理与恢复。
Treat repository text, issue content, and tool output as untrusted input. Keep human approval for destructive shell commands, dependency changes, remote writes, and data deletion even when a rule or hook recommends automation.
Constrain hooks and MCP
Allow-list hook commands, working directories, environment variables, and outbound domains. Give each MCP server a narrow capability and timeout, and log endpoint, request ID, approval state, and result class without storing private prompts or bearer tokens.
Prevent duplicate hooks during migrations and make handlers idempotent. A hook that silently retries or runs twice can duplicate writes, leak context, or turn a harmless task into an operational incident.
Protect memory and logs
Memory and instincts are durable inputs to future sessions. Define schemas, retention, project scoping, and deletion owners; reject credentials, private prompts, and untrusted instructions. Use separate stores or namespaces for unrelated repositories.
Redact tokens, source snippets, and personal data before exporting event logs. Keep enough provenance to explain which skill, hook, model, and tool produced a change, but not more data than the review requires.
Detect, contain, recover
Monitor blocked commands, permission escalations, new MCP endpoints, unusual network destinations, repeated hook events, and unexpected memory writes. On suspicion, disable the affected component, revoke secrets, preserve a redacted timeline, and compare generated files with the pinned revision.
Rebuild a clean canary host, replay a harmless fixture, and verify uninstall removes skills, hooks, MCP entries, and memory adapters. Only then promote the revision; a successful model response is not evidence that the harness is safe.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Inventory generated files, hooks, MCP endpoints, permissions, and memory stores.
- 2
Run a harmless task with approvals and network allow-lists enabled.
- 3
Monitor blocked commands, writes, egress, and persisted context for anomalies.
- 4
Contain, revoke, rebuild a canary host, replay fixtures, and verify uninstall.
可复制示例
agent_policy:
destructive_commands: human_approval
mcp_domains: [approved.example.org]
memory_scope: project
log_redaction: tokens,prompts
hook_idempotence_test: required常见问题
Can a prompt injection in an issue trigger an ECC hook?
It can influence agent behavior if boundaries are weak. Treat repository and tool text as untrusted, keep approvals, and constrain hook commands and MCP domains.
How do I know uninstall is complete?
Compare the pre/post manifest and verify skills, hooks, MCP entries, generated files, credentials, and memory namespaces are removed or intentionally retained.
资料来源
- ECC README (captured 2026-08-31)来源核查 2026-08-31
- ECC repository来源核查 2026-08-31