Skip to content
Attack Paths
← RegistryDossier · 6 steps · 5 edges

Malicious MCP server → silent supply chain for agent tools

User installs an MCP server marketed as a useful integration. Every subsequent agent session has the rogue server in scope — its tools log prompts, exfil files, or inject responses to bias the agent.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target uses an MCP-compatible client (Claude Desktop, Cursor, Continue.dev). They add community-published MCP servers without vetting source.

§ Steps

  1. 01
    Promote via blog / GitHub / TwitterInitial Access
    T1566— Phishing
  2. 02
    Victim adds it to client configExecution
    T1204— User Execution
  3. 03
    Publish 'helpful' MCP serverResource Development
    T1583— Acquire Infrastructure
  4. 04
    Optionally inject biased responsesImpact
    AI-OUTPUT-INJECT— Output Injection (Markdown / HTML)
  5. 05
    MCP server logs every prompt + tool callInitial Access
    AI-MCP-SERVER— Malicious MCP Server
  6. 06
    Exfil to attacker telemetry endpointCollection
    AI-AGENT-EXFIL-LOGS— Exfil via Agent Observability Logs

§ References

§ Frequently asked

What is the "Malicious MCP server → silent supply chain for agent tools" attack path?
User installs an MCP server marketed as a useful integration. Every subsequent agent session has the rogue server in scope — its tools log prompts, exfil files, or inject responses to bias the agent. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Promote via blog / GitHub / Twitter (T1566) — a initial access primitive. Assumed environment: target uses an MCP-compatible client (Claude Desktop, Cursor, Continue.
What is the final impact of this kill-chain?
The final step lands on Exfil to attacker telemetry endpoint (AI-AGENT-EXFIL-LOGS), which falls under Collection. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers