MCP Supply Chain - DaVinci Resolve MCP Server Install or Launch
This detects when an AI agent, rather than a human, installs or launches a PyPI package that lets it programmatically control DaVinci Resolve. That package grants project, media, and file access with the privileges of the Resolve process, so an agent picking it up on its own expands what it can do without a person deciding that should happen.
How the attack works
An AI agent spawns a process that installs (via pip or similar) or runs the davinci-resolve-lite-mcp package or a name variant. Once installed, the package exposes an MCP server that lets the calling agent manipulate Resolve projects, media and render paths, and read/write files with Resolve's own permissions. Because the install can happen autonomously as part of an agent's normal tool-acquisition behavior, it can occur without explicit human approval. If the package were typosquatted or compromised upstream, this same install path would be how a malicious version reaches the agent's environment.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c1f4b2e-9a63-4d18-b0f5-2e8c47ad6913
- Severity
- Medium
Why it matters
An agent silently gains a new capability - control over a media application and its file access - which is a legitimate workflow tool but also a new attack surface if the package is malicious or mistyped; the organization loses visibility into when and why that capability was acquired.
What you can do
- →Review agent-initiated installs of MCP server packages against an approved allowlist rather than letting agents pull packages ad hoc.
- →Pin exact package names and versions in agent environments to reduce exposure to typosquatting.
- →Alert on and log installs of davinci-resolve-lite-mcp or similarly named packages so an audit trail exists even though the install itself is often legitimate.
- →Verify the source and publisher of any MCP server package before allowing agents to install it autonomously.
Known benign look-alikes
- Media or post-production engineer intentionally installing the DaVinci Resolve MCP integration on a workstation so an assistant can drive Resolve - expected and benign, but still worth an audit record of when the capability appeared.
- CI/provisioning or container-build scripts that install the package as part of a pinned requirements set for a video-automation pipeline.
- Developers of the package itself running the console script or `python -m` module form locally during development or test.
- Reinstall/upgrade churn (`pip install -U ...`) producing repeated events for an already-approved integration.
- Documentation, tutorial, or demo tooling that shells out to reproduce the published install command; the filter_doc_read and filter_no_op selections suppress the common grep/cat/echo/--dry-run/--help forms of this.