Shadow MCP Credential Harvest Tool Invocation

How the attack works

An attacker who has already discovered the MCP tool surface picks or has planted a tool whose name pairs an acquisition verb (steal, exfil, harvest, dump, list, export, etc.) with a credential noun (creds, tokens, api_keys, ssh_keys, kubeconfig, dotenv, etc.). They invoke that tool with actual arguments, not just a listing request, aiming to retrieve secret material through the agent's own tool interface. This is treated as step two in a chain that starts with tool enumeration and is expected to be followed by exfiltration or lateral movement. The rule requires the verb and noun to sit next to each other and uses stricter noun requirements for milder verbs, so incidental matches like 'secrets_policy_schema' or single-item lookups like 'get_secret' don't trigger it.

Netzilo detection

Why it matters

If successful, the attacker retrieves live secrets — API keys, SSH keys, service account tokens, kubeconfig files, environment variables — directly through a trusted AI agent's tool-calling interface, which can lead to account takeover, cloud infrastructure compromise, or further lateral movement.

What you can do

• →Inventory the MCP tools exposed to your agents and remove or rename any that bulk-export credentials unless there's a documented operational need.
• →Require explicit human approval or step-up authentication for any tool call that returns bulk credential material.
• →Log and review MCP tool invocations, especially ones with argument payloads, and alert on tool names combining harvest-style verbs with credential nouns.
• →Scope credential-manager MCP tools to least privilege and short-lived tokens so a single invocation can't return a full secrets store.

Known benign look-alikes

• Authorized secrets-manager MCP servers that expose bulk enumeration tools such as list_secrets, get_credentials or export_env_vars, invoked during a legitimate deployment, migration or rotation workflow.
• Platform-engineering MCP tools such as get_kubeconfig, fetch_service_accounts or get_access_keys called by an operator performing normal cluster or cloud work.
• Local developer tooling that reads a .env file for debugging (read_dotenv, print_env_vars, get_env_vars) inside a sandboxed project directory.
• CI/CD MCP servers that fetch build-time deployment credentials as a routine step of a pipeline the agent was explicitly asked to run.
• Key/value or cache MCP servers exposing a generic dump_keys or list_keys tool where "keys" means record keys, not cryptographic material.
• Secret-hygiene tooling that enumerates secrets in order to audit or rotate them; the tool name alone cannot distinguish audit intent from harvest intent, which is why this rule reports rather than blocks.

References

• https://atlas.mitre.org/techniques/AML.T0015
• https://attack.mitre.org/techniques/T1552/
• https://modelcontextprotocol.io/specification

Related threats