Author
Nadia Ferreira-Strand
Operator's playbook writer · threat.cafe editorial persona
Fictional profile.
Nadia writes the runbooks and checklists that platform and security teams use when an agent pulls in something it should not have, with a verification step for every action. A fictional writer persona; articles are researched and fact-checked by the threat.cafe editors.
Writes on
- threat.cafe 10
10 posts
-
Official-looking isn't official: how to verify who published an MCP server named after a real vendor
The first malicious MCP server in the wild, postmark-mcp, was a copy of a real vendor's code under an unrelated npm account. A ten-minute routine that starts from the vendor's own docs catches that pattern before install.
-
Release-age cooldowns for agent installs: the cheap control that would have stopped axios, and its cost
Hijacked releases of axios and nx were live for roughly 2 to 12 hours. A one-day minimum release age blocks that window for every agent install. The cost is delayed fixes, so set an exact-version fast lane.
-
Your clients' staff are installing AI agents: an MSP's first 90 days of agent governance
MSP AI guidance covers chat tools and data leakage. Clients now run coding agents that install packages and load MCP servers. A 90-day plan - discover, set a default policy, enforce on managed endpoints, report.
-
Approved last month, malicious today: a re-verification cadence for MCP servers and skills
Install-time vetting decays the moment a server or skill changes. Tie every approval to an immutable version or hash, re-check on every change, and sweep on a schedule. Cadence by artifact type inside.
-
Tabletop: a malicious MCP server in your engineering org, with the kill-switch question every team fails
A 60-minute tabletop built from the postmark-mcp case. Five injects, a scoring sheet, and the question most teams cannot answer yet - how fast can you turn one MCP server off on every machine?
-
Unpatched edge devices sit behind 29% of opportunistic attacks: a KEV-only alert rule an MSP can staff
Alert clients only when a CISA KEV entry hits an internet-facing device or remote-access tool they actually run. In 2026 that has meant about 1.5 catalog entries a week to match, not the 1,200-plus CVEs a week a 66,000-CVE year implies.
-
You can't govern what you can't list: an inventory of skills, MCP servers and hooks across developer laptops
Agent add-ons live in per-user JSON files and folders that MDM, EDR and SIEM do not parse. Build the inventory from those files on every laptop and every checkout. Config-path map dated 15 October 2026, plus a collection script.
-
Egress allowlisting for coding agents and CI runners: the control that would have stopped the axios callback
Most agent-ecosystem malware has to phone home. An outbound allowlist on CI runners and agent sandboxes contains compromises that known-bad lists miss. Start in audit mode, then block. The ongoing cost is keeping the list current.
-
Prove your agent policy fires: a harmless canary suite for Claude Code hooks and MCP allowlists
Several hook and allowlist settings fail open without an error. Plant harmless canary entries that a working policy must block, test them on every release, and keep the results as audit evidence.
-
Your agent installed a known-bad package: the first hour, including the credentials you forgot it could reach
Isolate the machine, preserve the agent's logs and configs, rotate every secret the agent could read from a clean device, check memory files and persistence, then scope. A minute-by-minute runbook.
