MCP Server, Plugin or Skill Installed Outside a Tool Call

How the attack works

An agent (or something acting through it) writes a script instead of calling its own config-write tool directly. That script runs a shell command, a package postinstall hook, or a curl/download that drops a new MCP server definition, plugin manifest, or skill document into a config directory. Because this never goes through the agent's own Write tool, the normal audit trail for config changes doesn't capture it. The change is only visible by watching the file system for the resulting write, after it has already happened.

Netzilo detection

Why it matters

A malicious or unauthorized MCP server, plugin, or skill can get installed and start running with the agent's trust and permissions, without leaving the usual tool-call record that defenders would check first.

What you can do

• →Review MCP server, plugin, and skill config files for unexpected entries, especially ones not traceable to a known tool call or manual install.
• →Restrict which processes and users can write to agent config directories.
• →Log and alert on file writes to these config paths independently of agent tool-call logs, since tool-call logs alone won't show this activity.
• →Treat this as a detection of a completed write, not a block; pair it with controls at the tool-call layer if you need to prevent the write itself.

Known benign look-alikes

• A developer installing or upgrading an MCP server by hand while the agent is the monitored ancestor of their shell
• Package managers writing plugin manifests during an ordinary npm/pip install
• Editor extensions rewriting their own settings files
• Repository checkout materialising a committed .mcp.json

References

• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1543/

Related threats