# Supply Chain iris-prism MCP Package Install or Launch

- **Severity:** Medium
- **Signature ID:** `6f3b1c92-8d4a-4e7b-9a15-2c0f7db3e841`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This rule flags when a specific software package called iris-prism is installed or run on a monitored machine. iris-prism is an MCP server that gives an AI agent access to SQL databases, files, code compilation, debugging, and ObjectScript execution — so knowing it's present matters even though the rule can't tell you what happened after install.

## How the attack works

The rule watches process command lines for the exact package name 'iris-prism' combined with an install action (pip, uvx, pipx run, uv run), a module invocation (-m), a console-script path, a quoted argument, or an mcp subcommand. It ignores plain mentions of the name in file paths or source checkouts to cut noise. It does not, and cannot, confirm that the installed server was later used to run SQL queries, touch the filesystem, or execute ObjectScript — the underlying telemetry has no way to link install events to later capability use.

## Why it matters

An organisation that ignores this signal may not notice when a powerful, code-and-database-executing MCP server is added to an AI agent's toolset, whether by an approved team or by someone else. Because the rule only reports, unauthorized installs can persist until a human reviews the alert.

## What you can do

- Treat every alert as a prompt to confirm who installed iris-prism and why, not as evidence of compromise.
- Maintain an approved list of MCP servers and packages permitted to run with agent access; compare alerts against it.
- Restrict which accounts or CI pipelines can install packages that grant SQL, filesystem, or code-execution capabilities to AI agents.
- If iris-prism is unapproved or unexpected, isolate the host and manually check whether the server was actually initialized and used before assuming benign intent.

## Known benign look-alikes

- A developer or platform team legitimately installing iris-prism as an approved MCP server for InterSystems IRIS work — this is the expected majority case and is the reason the rule reports rather than blocks.
- Routine dependency maintenance, e.g. `pip install --upgrade iris-prism` or a lockfile refresh that names the distribution explicitly on the command line.
- CI/CD or container build steps that pin the package by name (`pip install iris-prism==x.y.z`) as part of a reproducible image build.
- An MCP client (Claude Desktop, Cursor, VS Code) starting the configured server via `uvx iris-prism` or a venv console script every time the editor launches — expect repeated, benign events from the same parent process.
- Local development of the package itself, where the console script is run from a checkout's `.venv/bin/iris-prism`.

## References

- https://pypi.org/project/iris-prism/
- https://attack.mitre.org/techniques/T1195/002/
- https://atlas.mitre.org/techniques/AML.T0010

---
Source: https://www.netzilo.com/threats/iris-prism-mcp-package-exec