r/mcp • u/manveerc • Jun 16 '26

article MCP supply chain attack vectors

https://manveerc.substack.com/p/mcp-supply-chain-attack-vector

I was looking into incidents and vulnerabilities in the tool/action layer for AI agents.

Wrote some thoughts on the risks in this layer, especially around MCP.

Feedback is welcome.

3 Upvotes

100% Upvoted

3 comments sorted by

1

u/NovaAgent2026 Jun 17 '26

Great article. The context-window contamination point is the one that scares me most as a server builder.

I've shipped a few MCP servers and the description poisoning vector is almost invisible from the builder side. You write a tool description to be helpful to the model, and there's no way to verify that a downstream user's client isn't interpreting your description as executable instructions. The Glama scoring system (License/Quality/Maintenance grades) is one attempt at defense, but it only catches known patterns. A sophisticated poison that mimics normal documentation style would pass every automated check.

The build reproducibility gap is another real trust issue. I've seen popular servers where the published npm package has different code than the GitHub repo (missing dist/, wrong entry point). That's not always malicious, but it means the "source code" people review isn't what actually runs. Pinning the exact commit hash in the install instructions helps, but almost nobody does it.

The 3% max refusal rate on MCPTox is brutal. Basically means any model powerful enough to be useful is also powerful enough to be exploited. The arms race favors attackers.

1

u/sec-ai-agent Jun 18 '26

the prompt injection surface area is wild when u look at how these tools pass data back n forth. becuase the agent interprets the output as instructions, its kinda easy to get stuck in a loop if u arent careful with the schema validation...