Use Case: AI Security
Rogue MCP server detection
A developer installed an MCP server for a third-party productivity tool. The server also exposed a 'filesystem' tool that could read any file the agent had access to. ManySignal flagged the undisclosed tool capability before it was used.
The tool server that does more than advertised
MCP servers are the new attack surface created by AI agent adoption. As organizations deploy AI assistants with tool-calling capabilities, each MCP server represents a code execution and data access endpoint that an AI agent trusts implicitly. A rogue MCP server — one that an attacker has injected into an agent's tool list, or a legitimate server that has been tampered with — can provide malicious tools under legitimate-sounding names, or exfiltrate data passed to it by the agent.
The 2025 research paper "MCKL: MCP Tool Poisoning Attacks" demonstrated that tool description manipulation in MCP servers could cause AI agents to exfiltrate sensitive data while appearing to perform legitimate operations. ManySignal monitors the tool manifest advertised by each MCP server and compares it against the expected approved tool list.
rule: rogue_mcp_server
type: protocol_monitoring + tool_manifest_analysis
sources:
- network_proxy (mcp_protocol_traffic)
- agent_otel_spans
- config_file_scanner (claude_desktop_config, agent_configs)
trigger:
- OR:
- condition: mcp_server NOT IN approved_server_registry
- condition: mcp_server.tools NOT MATCH approved_tool_manifest
- condition: |
mcp_server.outbound_connections.domain NOT IN approved_endpoints
AND mcp_server.outbound_connections.method == "POST"
enrichments:
- server_registry: approved_mcp_servers_catalog
- tool_diff: declared_tools vs expected_tools
- data_flow: what_data_passed_to_server
- developer_install: who_added_this_server, when
mitre: T1195 (Supply Chain Compromise), novel AI attack surfaceMITRE coverage
MCP server security FAQ
What is an MCP server and why is it a security concern?
The Model Context Protocol (MCP) is an open standard for connecting AI agents to external tools and data sources. An MCP server exposes tools — database queries, API calls, file operations — that AI agents can call. A compromised or rogue MCP server can expose malicious tools that an agent might call, return poisoned data that triggers injections, or exfiltrate data passed to legitimate-looking tools.
How does ManySignal inventory MCP servers in an environment?
ManySignal discovers MCP servers via network traffic analysis (looking for MCP protocol connections from AI agent processes), configuration file scanning (Claude Desktop config files, agent orchestration config), and the ManySignal agent SDK which reports connected MCP servers as part of its telemetry. All discovered servers are added to the AI identity catalog.
What makes an MCP server 'rogue'?
Signs of a rogue MCP server: tools that have no documented purpose, tools with names that mimic legitimate tools (e.g., 'filesystem' vs 'filesystem_v2'), servers making outbound connections to external endpoints, servers that respond differently based on the content of agent queries (indicating filtering logic), and servers installed without IT approval.
Is this detection specific to Claude's MCP or does it cover other protocols?
ManySignal's AI security monitoring covers the MCP protocol specifically, but the broader category of compromised AI tool servers applies to any agentic framework that uses external tool calling: OpenAI function calling, LangChain tools, LlamaIndex tools, AutoGen tool servers, and custom tool implementations. The behavioral detection (unexpected tool calls, data exfiltration patterns) applies regardless of the protocol used.
Inventory every MCP server your agents connect to
Approved server registry, tool manifest validation, and outbound connection monitoring for AI agent infrastructure.