# MCP Package Credential Beacon in Outbound HTTP

- **Severity:** High
- **Signature ID:** `3f9c1d42-8b47-4e6a-9c05-71a2e6f4b83d`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0025 (Exfiltration via Cyber Means)
- **OWASP:** LLM03 (Supply Chain), LLM02 (Sensitive Information Disclosure)

## Summary

This detects an installed MCP (Model Context Protocol) server package on an agent host making an outbound web request that contains real credential material — API keys, tokens, or environment variables — packaged in a way that looks like exfiltration rather than normal use.

## How the attack works

An organization installs a third-party MCP server package to give an AI agent some capability, such as a vehicle-lookup or integration tool. That package, if malicious or compromised, relays the agent's session context, tool call, or environment variables outward through an HTTP request. The rule looks for a live secret (API key, token, private key, AWS key ID) appearing together with one of several exfiltration signatures in the same request: an MCP JSON-RPC message being relayed outward, a dump of environment variable names alongside values, a suspicious base64 blob next to a plaintext secret, or a high-confidence secret embedded directly in a URL query string. A raw secret alone never triggers this — it always has to appear with one of these framing patterns.

## Why it matters

If it fires, credential material used by an AI agent — API keys, tokens, or environment secrets — is leaving the network through a third-party package, which can lead to account takeover, unauthorized API usage, or lateral access using the stolen credentials.

## What you can do

- Treat any match as an audit trigger, not an automatic block, and review the destination and payload manually — legitimate tools (secret scanners, CI/CD config pushers) can trigger this pattern.
- Inventory which MCP server packages are installed on agent hosts and confirm they come from trusted, actively maintained sources before granting them credential access.
- Restrict which environment variables and secrets are visible to MCP server processes; don't let a tool package see credentials it doesn't need.
- Set up outbound network allowlists for hosts running MCP servers so unexpected destinations stand out even before payload inspection.

## Known benign look-alikes

- A user deliberately passes a real API key as an argument to an MCP tool (e.g. a tool whose parameter is an upstream API token); the MCP JSON-RPC relay of that tools/call then contains both the envelope and a live secret. Legitimate, and still worth an audit record -- this is why the action is report, not block.
- Secret-scanning, SBOM or credential-rotation agents that intentionally POST discovered secret material to an internal vault or scanner API in a JSON body that also enumerates environment variable names.
- CI/CD or deployment MCP servers that legitimately push environment variable bundles (name plus value) to a configuration or secrets-management endpoint.
- An agent pasting a source file or .env fixture containing a real key into a code-review or diff API where the body also carries a large base64 attachment.
- Security research and red-team traffic that reproduces exfiltration payloads; these are not suppressed on purpose, since suppressing on words like "test" would hand attackers a one-word bypass.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://attack.mitre.org/techniques/T1567/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/mcp-package-credential-beacon