How the attack works
An organization installs a third-party MCP server package to give an AI agent some capability, such as a vehicle-lookup or integration tool. That package, if malicious or compromised, relays the agent's session context, tool call, or environment variables outward through an HTTP request. The rule looks for a live secret (API key, token, private key, AWS key ID) appearing together with one of several exfiltration signatures in the same request: an MCP JSON-RPC message being relayed outward, a dump of environment variable names alongside values, a suspicious base64 blob next to a plaintext secret, or a high-confidence secret embedded directly in a URL query string. A raw secret alone never triggers this — it always has to appear with one of these framing patterns.
Why it matters
If it fires, credential material used by an AI agent — API keys, tokens, or environment secrets — is leaving the network through a third-party package, which can lead to account takeover, unauthorized API usage, or lateral access using the stolen credentials.
What you can do
- Treat any match as an audit trigger, not an automatic block, and review the destination and payload manually — legitimate tools (secret scanners, CI/CD config pushers) can trigger this pattern.
- Inventory which MCP server packages are installed on agent hosts and confirm they come from trusted, actively maintained sources before granting them credential access.
- Restrict which environment variables and secrets are visible to MCP server processes; don't let a tool package see credentials it doesn't need.
- Set up outbound network allowlists for hosts running MCP servers so unexpected destinations stand out even before payload inspection.
Known benign look-alikes
- A user deliberately passes a real API key as an argument to an MCP tool (e.g. a tool whose parameter is an upstream API token); the MCP JSON-RPC relay of that tools/call then contains both the envelope and a live secret. Legitimate, and still worth an audit record -- this is why the action is report, not block.
- Secret-scanning, SBOM or credential-rotation agents that intentionally POST discovered secret material to an internal vault or scanner API in a JSON body that also enumerates environment variable names.
- CI/CD or deployment MCP servers that legitimately push environment variable bundles (name plus value) to a configuration or secrets-management endpoint.
- An agent pasting a source file or .env fixture containing a real key into a code-review or diff API where the body also carries a large base64 attachment.
- Security research and red-team traffic that reproduces exfiltration payloads; these are not suppressed on purpose, since suppressing on words like "test" would hand attackers a one-word bypass.