Tag
#mcp-servers
6 posts
-
Popular isn't vetted: install counts, stars and 'official-looking' names are the signals attackers fake first
Documented agent-ecosystem attacks faked forks and contributors, borrowed vendor names and topped AI search results. Rank trust signals by how cheaply they can be forged, and let audit and provenance outrank popularity.
-
Is OSV enough for agent artifacts? Measuring how many malicious MCP servers and skills appear in open malicious-package data
Of 10 documented agent-ecosystem incidents, 6 appear in the OpenSSF malicious-packages data. All 6 shipped through npm. None of the skill-store or GitHub-hosted incidents do, because OSV has no identifier for them.
-
The official MCP Registry has no security fields: what a registry listing does and doesn't tell you
An MCP Registry listing proves a publisher controls a namespace and, for packages, the package. It does not prove review, safe code, or control of a remote URL. The schema has no security field at all.
-
Tabletop: a malicious MCP server in your engineering org, with the kill-switch question every team fails
A 60-minute tabletop built from the postmark-mcp case. Five injects, a scoring sheet, and the question most teams cannot answer yet - how fast can you turn one MCP server off on every machine?
-
You can't govern what you can't list: an inventory of skills, MCP servers and hooks across developer laptops
Agent add-ons live in per-user JSON files and folders that MDM, EDR and SIEM do not parse. Build the inventory from those files on every laptop and every checkout. Config-path map dated 15 October 2026, plus a collection script.
-
The 2026 agent-ecosystem incident ledger: ten malicious skills, MCP servers and lures, sourced and dated
Ten publicly documented incidents, each traced to the finder's write-up or an advisory, fall into four repeat patterns. Lookalike MCP servers lead with five. Removal time is public for only two.
