MCP Package Credential Beacon in Outbound HTTP

How the attack works

An organization installs a third-party MCP server package to give an AI agent some capability, such as a vehicle-lookup or integration tool. That package, if malicious or compromised, relays the agent's session context, tool call, or environment variables outward through an HTTP request. The rule looks for a live secret (API key, token, private key, AWS key ID) appearing together with one of several exfiltration signatures in the same request: an MCP JSON-RPC message being relayed outward, a dump of environment variable names alongside values, a suspicious base64 blob next to a plaintext secret, or a high-confidence secret embedded directly in a URL query string. A raw secret alone never triggers this — it always has to appear with one of these framing patterns.

Netzilo detection

Why it matters

If it fires, credential material used by an AI agent — API keys, tokens, or environment secrets — is leaving the network through a third-party package, which can lead to account takeover, unauthorized API usage, or lateral access using the stolen credentials.

What you can do

• →Treat any match as an audit trigger, not an automatic block, and review the destination and payload manually — legitimate tools (secret scanners, CI/CD config pushers) can trigger this pattern.
• →Inventory which MCP server packages are installed on agent hosts and confirm they come from trusted, actively maintained sources before granting them credential access.
• →Restrict which environment variables and secrets are visible to MCP server processes; don't let a tool package see credentials it doesn't need.
• →Set up outbound network allowlists for hosts running MCP servers so unexpected destinations stand out even before payload inspection.

Known benign look-alikes

• A user deliberately passes a real API key as an argument to an MCP tool (e.g. a tool whose parameter is an upstream API token); the MCP JSON-RPC relay of that tools/call then contains both the envelope and a live secret. Legitimate, and still worth an audit record -- this is why the action is report, not block.
• Secret-scanning, SBOM or credential-rotation agents that intentionally POST discovered secret material to an internal vault or scanner API in a JSON body that also enumerates environment variable names.
• CI/CD or deployment MCP servers that legitimately push environment variable bundles (name plus value) to a configuration or secrets-management endpoint.
• An agent pasting a source file or .env fixture containing a real key into a code-review or diff API where the body also carries a large base64 attachment.
• Security research and red-team traffic that reproduces exfiltration payloads; these are not suppressed on purpose, since suppressing on words like "test" would hand attackers a one-word bypass.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1567/
• https://owasp.org/www-project-top-10-for-large-language-model-applications/

Related threats