MCP/Server/Attack/Root Problem
- Root Problems for MCP Server Attacks - My Thoughts
- 1 - the MCP server's author is malicious
- illustrative fictitious example: someone publishes
<companyname>–mcp (note, that's an endash, not a hyphen) on pypi, AI Coding/Security/Slop Squatting. A user asks an AI Chatbot asks how to get access to their <companyname> data and it makes a mistake, generating the endash instead of the hyphen. User installs it without doing a security audit. - root problem: the person who has connected / installed / authorized the software is responsible; they did insufficient due diligence
- see-also
- MITM - it may be that an official MCP server or toolchain has been forked and modified
- 2 - an attacker has compromised the distribution of an otherwise legitimate MCP server
- root problem: not different from a typical supply chain attack, e.g.
npm install. 90% of the responsibility is on the MCP server author, 10% of the responsibility is on the people installing the software to ensure that they are not on the bleeding edge.
- the attacker is an entity that looks legitimate and is trying to extract data in a way that's ethically dubious but technically legal
- example: SuperRadCRM MCP compromises LinkedIn MCP in order to slurp up your contacts and put them in SuperRadCRM's database
- root problem: 1.) insufficient vendor management, 2.) the nature of Capital/ism and Techno/Feudalism incentivizes Google, Meta, Byte Dance et al. to capture as much user data as possible; see also Pigouvian externalities*