MCP Minecraft Control (vitaminmcp) Agent Process Spawn
This rule flags when an AI agent starts processes tied to vitaminmcp, a tool that lets the agent control Minecraft servers and bots. It matters because that same capability can be used to open outbound network connections and operate infrastructure without human review.
How the attack works
An AI agent has vitaminmcp wired in as one of its available tools. When invoked, it spawns a Minecraft protocol bot library (mineflayer, prismarine, or node-minecraft-protocol), a Paper/Spigot/Purpur/Folia server jar, or a client connecting to Minecraft's game (25565) or RCON (25575) ports. The rule watches for this process launch, which is the point where the agent moves from having the capability configured to actually exercising it. Because the underlying protocol-bot code is a general-purpose socket client, the same mechanism could be repurposed for other outbound network activity beyond Minecraft.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b3f9c42-5d18-4a6e-9f2b-8c41d0a7e365
- Severity
- Medium
Why it matters
An organization loses assurance that AI agents are only doing approved work: this gives an agent the ability to start, join, command, and disrupt live game servers, or use the same networking machinery for other unauthorized outbound connections, all without a human approving each action.
What you can do
- →Restrict which MCP tools an agent can load, and review whether vitaminmcp is needed outside dedicated development or CI environments.
- →Alert on this process spawn only where the host is not a known plugin-dev or CI machine, since legitimate Minecraft plugin testing is a common and expected trigger.
- →Review flagged events manually rather than auto-blocking, since the rule is scoped to report and cannot distinguish intended use from misuse by content alone.
- →Isolate any host running both an AI coding agent and Minecraft server/bot software from production networks, since the game-server ports and bot library can serve as a general outbound connection point.
Known benign look-alikes
- Minecraft plugin developers using vitaminmcp for its intended purpose — driving a local Paper test server from an agent during plugin development.
- CI or integration test runs in a Minecraft plugin repository that boot a Paper/Spigot jar and connect a mineflayer bot as part of the test harness.
- A developer workstation that happens to run a personal Paper server or a mineflayer script while an AI coding agent is also monitored on the same machine.
- Node.js projects that install or execute mineflayer/prismarine packages during ordinary dependency work.
- Game-server operations tooling (mcrcon, RCON admin scripts) run by an operator on a monitored host.