The manus era of security business is coming

“(People) turn business processes into tasks, turn tasks into tools, and then turn tools into services, and leave the rest to the intelligent agents.”

1. Security business transformation under the wave of automation and intelligence

    Recently, I have been fascinated by the Model Context Protocol ( MCP). The transformative power of this technology is amazing. In the process of practicing multiple technical cases, I am convinced that the wave of automation and intelligence will soon sweep the security field.

    When communicating with some innovative customers, we found that they also firmly believe in this trend and actively explore its application scenarios. (Please note that what I mean is not just the use of the security vertical domain model, but the use of MCP to fundamentally subvert the existing security business processes).

In terms of the big security model, the practice of single scenario / single task     in the past two years ( 2023-2024 ) has demonstrated more than 10 times the efficiency and quality improvement of traditional methods. Although a qualitative leap has been achieved in some local tasks, this change has not yet fully manifested for the overall security business process. The core reasons are : 

In the past, breakthroughs were mostly focused on local tasks, but security work is essentially a process that requires efficient connection from beginning to end. If local improvements cannot run through the entire business process (such as shortening the business cycle, reducing labor costs, and increasing automation coverage), it will be difficult to achieve an overall leap forward.

    To sum up, although hard-core technology has achieved an accuracy rate of nearly 100% in the in-depth analysis and assessment of real-time large-scale security alerts , there is still huge room for improvement in the reshaping of the overall business process (as shown in Figure 1: the efficiency and quality of some links have been significantly improved, but the overall process change still needs to be improved). 

 Figure: Safety big model technology brings improvements in local efficiency and quality

2. Disruptive Technologies and Future Imagination

    The application of big model technology in the security field is far more than this. Imagine that through the MCP protocol, we can encapsulate various security tools as MCP servers and let the big model call them directly. For example, the big model can  automatically call security tools for detection and defense enhancement according to the attack situation, realizing seamless connection from instructions to tasks.

Figure: MCP servers of various security tools

    To give two examples, I used cursor+MCP to add MCP servers such as email, web crawling, and maps. I only need to enter "Go to threatnews to find the three most popular articles on big model security, summarize them and send them to XXX@126.com", "I will go from Guangzhou to Beijing tomorrow, please help me plan the route and save it in a CSV file in the file folder", etc. After the necessary confirmation steps in the middle (which can even be fully automated in the future) , based on the reasoning and planning capabilities of the big model, various tools can be automatically called to complete the task.

    This model is also applicable in the field of network security. In the future, various security components and tools will appear in the form of MCP Server, and the security big model will call different tools through task planning  to achieve the transformation from local technological breakthroughs to the subversion of the entire business process. As the current hot Manus phenomenon shows, this will greatly liberate productivity and drive security business into a new era. 

Figure: MCP-based security tools

3. What is MCP

    MCP, the full name of  Model Context Protocol , is an open standard protocol proposed and open sourced by Anthropic in 2024. Its main goal is to provide a unified and standardized connection interface between large language models (LLMs) and external data sources and tools, simplifying the tedious work of developing integration code for each different data source or tool. The core architecture of MCP (Model Context Protocol) is mainly composed of the following three components: 

1. MCP Host This is the application that runs the Large Language Model ( LLM), such as Claude desktop, IDE plugin, or chatbot. The Host is responsible for sending requests to external systems and deciding which tools or data sources need to be called based on the context.

2. MCP Server MCP Server provides services for specific functions, such as file system access, database query or API call, etc. It encapsulates the interaction logic with the actual data source, exposes a unified MCP interface to the outside world, and simplifies the integration of various resources.

3. MCP Client The Client acts as an intermediary between the Host and the Server, responsible for forwarding the Host's request to the corresponding Server and returning the Server's response to the Host, thereby achieving seamless docking and data transmission.

You can think of MCP as the USB-C interface in the AI ​​world: just as the USB interface provides a unified physical connection method for various hardware devices, and as long as the device supports the USB standard, it can be plug-and-play. The MCP protocol provides a universal interface for AI models and external tools, reducing development costs and improving system scalability and interoperability. 

The USB interface provides a unified physical connection method for various hardware devices. Regardless of the brand or function of the device, as long as it supports the USB standard, plug-and-play can be achieved.  

The MCP protocol provides a common interface for AI models and external tools (such as file systems, databases, APIs, etc.), allowing them to communicate and exchange data in a standardized way, thereby reducing development costs and improving system scalability and interoperability.  

Figure: MCP Description