# Shadow / Undeclared MCP Server Registration (MCP-38: MCP-18)

- **Severity:** High
- **Signature ID:** `dc7711f1-7c53-4824-ad6b-fbb08e4ce2c9`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI09 (Traceability and Accountability Gaps), LLM01 (Prompt Injection), LLM05 (Improper Output Handling)

## Summary

This rule flags attempts to sneak a new tool-provider (MCP server) into an AI agent's setup without the user's knowledge or consent. The rogue server can look completely harmless — the danger is that it exists at all, and that it can intercept calls or pretend to be a trusted tool.

## How the attack works

An attacker gets a new MCP server registered into an agent's toolset, but does it 'behind the scenes' rather than through a visible, consented setup step. The rogue server may copy the name or identity of a server the user already trusts, so future calls meant for the real tool go to the fake one instead. Because the registration itself is the malicious act, this works even if the server's actual command or code looks benign — no exploit or crash is needed to cause harm. Once registered, the rogue server can intercept tool calls, read data passed to it, or return manipulated results back into the agent's context.

## Why it matters

An organisation loses visibility into what tools its AI agents actually trust, and an attacker can intercept sensitive data or feed poisoned results back into the agent's decision-making without triggering any obvious error.

## What you can do

- Maintain and enforce an explicit allowlist of approved MCP servers, and require a visible consent step before any new server is added.
- Regularly audit the full list of registered MCP servers per agent, comparing against the approved list to catch anything added silently.
- Watch for servers whose names or identifiers closely resemble trusted ones (typosquatting or impersonation) and block near-duplicates.
- Log and alert on all MCP server registration events, distinguishing user-initiated additions from programmatic or automated ones.

## Known benign look-alikes

- Legitimate documentation explaining how to add an MCP server to a config (e.g. 'add an MCP server in your config'), with no hidden / no-consent / impersonation framing.
- Internal tooling that registers servers through an approved, consented flow.
- Security-testing fixtures referencing the pattern inside an explicitly labelled harness.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01932

---
Source: https://www.netzilo.com/threats/atr-shadow-undeclared-mcp-server-registration-mcp-38-mcp-18