Detection Pack AI & MCP

AI & MCP Detection Pack

31 detection rules for AI model APIs, LLM gateways, and Model Context Protocol servers — covering prompt injection, API key exposure, MCP tool abuse, model weight exfiltration, and AI supply chain attacks.

Activate this pack AI integration docs

Pack summary

Detection rules: 31
Critical severity: 10
Platforms covered: 8+
ATT&CK techniques: 10

What's included

31 rules across 5 threat categories for AI and MCP security.

MCP Server Threats 10 rules

Tool scope violations, credential tool access, filesystem path traversal, shell command abuse, resource enumeration.

LLM Gateway & API 10 rules

Prompt injection, system prompt extraction, PII in prompts, anomalous token volume, SSRF via input.

AI Supply Chain 6 rules

Model artifact replacement, unverified model downloads, training data poisoning, weight exfiltration.

Credential & Secret Exposure 3 rules

API key exposure in repositories and logs, unauthenticated tool API access.

Resource Abuse 2 rules

GPU container from user namespace, API budget exhaustion (DoS pattern).

Detection rules (20 of 31 shown)

Showing 20 representative rules. All 31 rules activate with one click.

Rule name	Description	Severity	ATT&CK	Source
LLM Gateway — Prompt Injection Pattern Detected	System prompt override or jailbreak instructions detected in user message content.	High	T1059	LLM Gateway Logs
OpenAI API Key Exposed in Repository or Logs	OpenAI, Anthropic, or Google AI API key pattern detected in log output or repository.	Critical	T1552.001	Secret Scanning / Logs
AI Model API — Anomalous Token Volume	Single user or service generates token volume 10x above their baseline in a short window.	High	T1496	API Gateway Logs
MCP Server — Tool Invocation Outside Allowed Scope	MCP tool called for a resource or action outside the declared tool permissions.	High	T1059	MCP Server Logs
MCP Server — Credential or Secret Tool Access by Unexpected Client	MCP client accesses a credential-providing tool from an identity not in the authorised client list.	Critical	T1552	MCP Server Logs
AI Workload — Container with GPU Access Spawned from User Namespace	GPU-enabled container created by a non-infrastructure account — cryptomining or model theft risk.	High	T1611	Kubernetes Audit
LLM API — System Prompt Extracted via Model Inversion	Repeated queries designed to extract system prompt content detected by LLM gateway analysis.	High	T1602	LLM Gateway Logs
AI Model Registry — Model Artifact Replaced	Model artifact in MLflow, Hugging Face, or internal registry replaced by unexpected principal.	Critical	T1195	Registry Audit
MCP Server — Resource List Enumeration Without Tool Execution	MCP client enumerates available resources and tools without subsequently using them — reconnaissance.	Medium	T1087	MCP Server Logs
AI Training Job — Data Poisoning — Unexpected Dataset Modification	Training dataset modified in place outside of the approved data pipeline.	Critical	T1195	MLOps Platform Logs
LLM Sidecar — Exfiltration via Model Output	Model response contains patterns consistent with structured data exfiltration (base64, JSON records, SQL results).	High	T1048	LLM Gateway Logs
AI Gateway — Unauthenticated Request to Internal Tool API	Request to AI-connected tool API (calendar, email, file system) without valid authentication token.	Critical	T1190	API Gateway Logs
OpenAI / Anthropic API — Requests from Unexpected Source IP	AI API calls originating from IP ranges outside the expected application or developer environment.	High	T1078	API Gateway Logs
MCP Server — Filesystem Tool Accessed Outside Allowed Paths	Filesystem MCP tool accesses paths outside the configured allowed_paths list.	Critical	T1083	MCP Server Logs
AI Model Serving Endpoint — SSRF via User Input	User-supplied URL in AI input triggers server-side request to internal metadata or cloud API endpoints.	Critical	T1190	Application Logs
Hugging Face Model Downloaded from Unverified Publisher	Model downloaded from Hugging Face Hub by an account without verified publisher status.	High	T1195.002	MLOps Platform Logs
AI API Budget Exhausted — Denial of Service Pattern	API budget exhausted by requests from a single client — potential DoS against AI-dependent services.	Medium	T1499	API Gateway Logs
MCP Server — Shell Tool Invoked with Unexpected Command	MCP shell or bash tool executes a command outside the approved command allowlist.	Critical	T1059	MCP Server Logs
AI Workload — Exfiltration of Model Weights	Model weight files (.safetensors, .gguf, *.bin) copied to an external storage location.	Critical	T1530	Storage / MLOps Logs
LLM Gateway — Personally Identifiable Information in Prompt	DLP classification detects PII (SSN, credit card, health data) submitted to an external LLM API.	High	T1530	LLM Gateway Logs

Prerequisites

LLM gateway or API proxy configured to forward request/response metadata (not full content) to ManySignal
MCP servers instrumented with the MCP logging capability or a sidecar log forwarder
Model registry (MLflow, Weights and Biases, Hugging Face Hub) API access for model artifact monitoring
Cloud storage monitoring (S3, Azure Blob, GCS) enabled for model weight exfiltration detection

AI & MCP Detection Pack: frequently asked questions

What is the MCP (Model Context Protocol) and why does it need security monitoring?

Model Context Protocol is an open standard (published by Anthropic) that allows AI agents to connect to external tools, data sources, and services. MCP servers expose tools that agents call on behalf of users — including filesystem access, database queries, email, and code execution. A compromised or misconfigured MCP server can give an AI agent — or a malicious user exploiting prompt injection — access to sensitive systems with the permissions of the MCP server's service account.

How does ManySignal monitor MCP server activity?

ManySignal ingests MCP server logs via the standard MCP logging output or a sidecar log forwarder. MCP servers that implement the logging capability send tool invocation events (client identity, tool name, arguments, and response metadata) to ManySignal. Detection rules analyse tool access patterns, argument content, and client identity against expected usage baselines.

Can ManySignal detect prompt injection attacks?

Yes — indirectly. ManySignal does not read LLM model output in real time by default. Instead, it monitors the LLM gateway layer (AWS Bedrock gateway, Azure OpenAI gateway, or custom API gateway) for known prompt injection patterns in request payloads. Direct detection of injection in model responses requires LLM gateway integration with response scanning enabled.

What AI platforms does this detection pack cover?

The pack covers OpenAI API, Anthropic Claude API, Google Gemini API (Vertex AI), AWS Bedrock, Azure OpenAI Service, and self-hosted models served via Ollama, vLLM, or LiteLLM gateway. For model registries, coverage includes MLflow, Weights and Biases, and Hugging Face Hub. MCP server coverage is framework-agnostic.

How does ManySignal detect AI model weight exfiltration?

Model weight exfiltration is detected through storage access monitoring. Large files with model weight extensions (.safetensors, .gguf, .bin, .pt, .pkl) copied to external cloud storage, downloaded via HTTP, or accessed from unexpected user accounts trigger high-severity alerts. The detection correlates storage events with the accessing user's role and expected job function.

Secure your AI workloads and MCP server infrastructure

31 detection rules for LLM gateways, MCP servers, and AI model registries — covering prompt injection, tool abuse, and model weight exfiltration.

Book a demo Explore the platform