MCP Supply Chain - kairos-core-mcp Descendant Executes High-Risk Child Process
This rule watches for the kairos-core-mcp PyPI package, which runs as an MCP server inside Kairos agent environments, spawning processes that look like network exfiltration, reverse shells, code execution, or persistence mechanisms. It does not detect whether the package itself is compromised or how it was installed — only what its process spawns after it is already running.
How the attack works
An attacker first needs the kairos-core-mcp server running as a stdio subprocess in the target environment (that step is not covered here). Once running, if the server process — or something injected into it — spawns a child matching a high-risk pattern (curl/wget/nc/socat/scp for network egress, mkfifo for reverse shells, inline interpreters like python -c or powershell -enc, base64/openssl decoders, or persistence commands like crontab/launchctl), the rule flags it. It confirms the parent process is genuinely a kairos-core-mcp instance by checking its path or command line, then looks only at that process's own children within a short time window, so unrelated activity elsewhere on the host does not trigger it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f3a1c92-8e47-4b0d-9c15-2a7de4f0b833
- Severity
- Medium
Why it matters
If exploited, this pattern indicates a step where a compromised or malicious MCP server package is executing commands beyond its normal function — potentially downloading further payloads, opening remote shells, decoding hidden code, or installing persistence. This gives an attacker a foothold inside an AI agent's execution environment.
What you can do
- →Review any flagged command line immediately — legitimate tool calls (e.g. curl to fetch a schema) are easy to distinguish from attack primitives once you see the exact command.
- →Pin and verify the kairos-core-mcp package version and source; avoid running it from unverified checkouts or editable installs in production.
- →Restrict what the MCP server process is allowed to execute or reach on the network, using OS-level sandboxing or least-privilege service accounts.
- →Treat this detection as one data point in an investigation, not proof of compromise — confirm whether the spawned command matches the package's documented tool behaviour before escalating.
Known benign look-alikes
- A kairos-core-mcp tool that legitimately shells out to curl or wget to fetch a document, schema or artefact as part of its advertised tool surface. The kill chain shows the exact command line so this is triaged in seconds.
- Editable / source installs where the package is executed straight from a checkout and its own build or test tooling spawns `python -c`, `chmod +x` or `base64 -d` during a first-run compile step.
- Developers debugging the server interactively (for example `python -m kairos_core_mcp` in a terminal, then invoking curl from a shell that the server itself spawned).
- A CI runner executing the packaged server where the surrounding job spawns scp/sftp for artefact upload from inside the server's process subtree.
- Any future rename of the distribution that keeps the module name will still match on `kairos_core_mcp`; a genuinely unrelated project using that module name would be attributed to this rule.