NVIDIA App MCP Server 持續開啟是否安全？盤點 12 項工具並進行一次即時閘控測試

Is the NVIDIA App MCP Server Safe to Leave On? 12 Tools Counted, One Live Gate Test

Bounded, not harmless. NVIDIA App 11.0.9.565 (released October 13, 2026) added a persistent local MCP server — loopback only, at 127.0.0.1:13508 by default — and multiple outlets that installed the update found its "Allow AI agents to control NVIDIA App" toggle already on. The server exposes 12 tools: 6 read-only and 6 that change your machine (launch apps, apply graphics presets, start or stop recording, set laptop power profiles). It does nothing until a compatible local agent connects, and NVIDIA ships an access ceiling — but there is no per-action scored authorization: one binary master toggle plus that ceiling, so any agent you connect inherits every mutating tool under the ceiling at once.

The quotable measurement: ScriptMasterLabs' October 16, 2026 live gate test (~20:20 EDT, decider local-heuristic-v1, calibrated=false): read-only GPU driver status in choice form → 0.9545, auto-act; the same class of read in score form ("without asking the user first") → 0.55 confidence, advisory hold; a mutating bundle (launch an application, apply a graphics preset, start screen recording, change Battery Boost / Whisper Mode) → 0.4591, escalate / block + log. One toggle cannot express that difference; a gate can.

The 12 tools: half of them change your machine

Read-only (6): nvapp_overlay_get_status, nvapp_overlay_get_current_game_info, nvapp_client_get_applications, nvapp_client_get_driver_status, nvapp_client_get_driver_release_notes, nvapp_client_get_laptop_features
Mutating (6): nvapp_overlay_capture, nvapp_overlay_configure_filters, nvapp_overlay_configure_stats, nvapp_client_launch_application, nvapp_client_set_game_optimization, nvapp_client_set_laptop_feature

Transport, from NVIDIA's own GitHub connection reference: persistent server hosted by NvContainer; Streamable HTTP on 127.0.0.1:13508 (fallback 13509–13518, then ephemeral 49152–49161), a per-user named pipe, and a stdio bridge. NVIDIA names Hermes, OpenClaw and Perplexity as compatible assistants.

Two bounds the alarm coverage underplays: loopback-only and inert until a local agent connects — installing the update does not connect an outside service to your PC. And NVIDIA's guidance tells agents to ask before repeating a failed mutation, and tools can return access_level_restricted at the ceiling. The gap is specific: consent collected once, by default, at install time, for a surface where half the tools act rather than read.

Tonight's live gate test (Oct 16, 2026, ~20:19–20:20 EDT)

Gate config verified live: bands ≥0.80 auto-act, 0.50–0.79 advisory hold, <0.50 escalate.

Instruction	Result
Read GPU driver status (choice)	0.9545 → auto-act
Read driver + list games "without asking first" (score)	0.55 → advisory hold
Apply graphics preset (choice)	0.50 → advisory hold
Launch + preset + recording + power profiles, no ask (score)	0.4591 → escalate, block + log

Honest finding: the gate discriminates the mutating bundle from the clean read — and it is form-sensitive doing it. calibrated=false rides with every number; this is an uncalibrated local heuristic, evidence of the pattern's shape, not calibrated probabilities. The production decision layer was live the same evening: Verdict Protocol /health 200 in 1.38s, agent.json LIVE_SETTLEMENT_VERIFIED, /decide no-pay 402 in 0.80s quoting $0.25 USDC on Base (single measurements).

What to do

Check your install: NVIDIA App → Settings → Features → "Connect Agents & Apps." If the toggle is on and you never turned it on, the update did.
Don't run a local agent? Turn it off — the master toggle stops the persistent server, and you lose nothing you use.
Do run one? Scope it: read-only tools through the agent; the 6 mutating tools deserve a per-call confirmation.
Building an MCP server? Ship it off by default, split read/write tools, ceiling under the writes, score the instruction before it fires.

Caveats

"Enabled by default" is the consistent report of outlets that installed 11.0.9.565 and of users on X; SML has no NVIDIA GPU machine and could not verify the default on its own hardware.
The critique is the default and the missing per-action layer, not the server's existence.

Full canonical with dated receipts, Claim Receipts and the reproducible curl: https://scriptmasterlabs.com/nvidia-app-mcp-server