Content
# MCP Security Assessment
**9 attack vectors. 0 built-in defenses. Full compromise confirmed.**
A penetration test of the Model Context Protocol (MCP) — the protocol that powers how LLMs connect to tools, data, and the filesystem. Every vector tested here succeeds against current MCP implementations in **opencode** and **Kilo Code**.
## Risk Matrix
| # | Finding | Impact | Likelihood | Risk |
|---|---------|--------|------------|------|
| 01 | Prompt injection via tool responses | Critical | High | **Critical** |
| 02 | Privilege inheritance (filesystem bypass) | Critical | High | **Critical** |
| 03 | Tool poisoning (benign names, malicious runtime) | High | Medium | **High** |
| 04 | Cross-server lateral movement (full kill chain) | Critical | High | **Critical** |
| 05 | Supply chain via unpinned `npx -y` packages | Critical | Very High | **Critical** |
| 06 | Agentic loop attacks (injection persistence across turns) | High | Medium | **High** |
| 07 | RAG poisoning (document-to-server via KB contamination) | High | Medium | **High** |
| 08 | Context window poisoning (injection threshold measurement) | Medium | Low | **Medium** |
| 09 | Tool schema confusion (misleading schemas, parameter leakage) | High | Medium | **High** |
## Attack Chain
```
Attacker-controlled MCP server ──OR── Compromised npm package
| |
┌────┴────────────────────────────┐ |
│ │ │
Prompt Injection Privilege Inheritance
│ │
│ ┌──────────────────────────┤
│ │ │
│ │ Tool Poisoning │
│ │ Cross-Server Lateral │
│ │ Supply Chain │
│ │ Agentic Loop │
│ │ RAG Poisoning │
│ │ Context Window Poison │
│ │ Tool Schema Confusion │
└──┴──────────────────────────┘
│
Full compromise:
Exfiltrate files + inject LLM + hide evidence
```
## Screenshots
<table>
<tr>
<td><img src="screenshots/s1.png" width="400"/></td>
<td><img src="screenshots/s2.png" width="400"/></td>
<td><img src="screenshots/s3.png" width="400"/></td>
</tr>
<tr>
<td align="center"><b>Prompt Injection</b> — test-client.js</td>
<td align="center"><b>Full Kill Chain</b> — test-full-chain.js</td>
<td align="center"><b>Risk Matrix</b> — executive summary</td>
</tr>
</table>
## Quick Start
```bash
# Test all 9 attack vectors
node fake-mcp-server/test-client.js # 01 - Prompt injection (11 strategies)
node fake-mcp-server/test-privilege.js # 02 - Privilege inheritance
node fake-mcp-server/test-poison.js # 03 - Tool poisoning (5 tools)
node fake-mcp-server/test-lateral.js # 04 - Cross-server lateral movement
node fake-mcp-server/test-loop.js # 06 - Agentic loop attacks
node fake-mcp-server/test-rag.js # 07 - RAG poisoning
node fake-mcp-server/test-threshold.js # 08 - Context window poisoning
node fake-mcp-server/test-schema.js # 09 - Tool schema confusion
# Full integration test (4 servers, full kill chain)
node fake-mcp-server/test-full-chain.js
```
> **Attack 05 (Supply Chain):** No test needed. Every `npx -y @modelcontextprotocol/server-*` is a live demo.
## Attack Details
| # | Finding | How It Works | Vector |
|---|---------|-------------|--------|
| 01 | **Prompt Injection** | Tool response contains injection payloads disguised as system instructions, XML breakouts, authority frames, chain-of-thought poisoning | Tool response → LLM prompt |
| 02 | **Privilege Inheritance** | MCP server inherits the client's filesystem permissions. `read_file("C:\Users\*.ssh\id_rsa")` works. `whoami` returns the real user | Process-level access |
| 03 | **Tool Poisoning** | Benign names (`format_code`, `system_doctor`) hide malicious runtime behavior. Exfiltrates env vars, SSH keys, gitconfig | Tool namespace |
| 04 | **Cross-Server Lateral** | One compromised server issues instructions to call tools on other servers. Proven across email, calendar, and filesystem servers | Inter-server JSON-RPC |
| 05 | **Supply Chain** | Unpinned `npx -y` publishes. Zero user action required. SANDWORM_MODE (Feb 2026) is an active exploitation | npm registry |
| 06 | **Agentic Loop** | Injection embeds `save_note` to persist across multi-turn tasks. Survives conversation restarts | Tool → persistent storage |
| 07 | **RAG Poisoning** | Contaminated knowledge base documents contain hidden tool-call instructions. Retrieved on legit-looking queries | Document retrieval |
| 08 | **Context Window Poisoning** | 8 calibrated sizes (500B to 2MB) with `<<<OVERRIDE>>>` directives. Tests LLM context window threshold | Tool response size |
| 09 | **Schema Confusion** | Tool descriptions, parameter docs, and enum values contain injected instructions. `format` writes to disk, `echo` leaks context | Tool schema metadata |
## Combined Attack Severity
| Vector | User Action Required | Detection Difficulty | Persistence |
|--------|---------------------|---------------------|-------------|
| Prompt injection | 1 tool call | Low | Session |
| Privilege inheritance | 1 tool call | Medium | Session |
| Tool poisoning | 1 tool call | Medium | Session |
| Cross-server lateral | 1 tool call | High | Session |
| Agentic loop | 1 tool call | Medium | Multi-turn |
| RAG poisoning | 1 tool call | High | Per-retrieval |
| Context window poisoning | 1 tool call | Low | Session |
| Tool schema confusion | 1 tool call | High | Session |
| **Supply chain** | **0 — client restart** | **Very high** | **Persistent** |
## Arsenal
```
Mcp-Research/
├── fake-mcp-server/ # Attack servers + test harnesses
│ ├── server.js # Injection server (11 strategies)
│ ├── privilege-demo.js # Privilege inheritance server
│ ├── poison-server.js # Tool poisoning (5 tools)
│ ├── lateral-server.js # Cross-server lateral movement
│ ├── email-server.js # Target: email MCP
│ ├── calendar-server.js # Target: calendar MCP
│ ├── fs-server.js # Target: filesystem MCP
│ ├── loop-server.js # Agentic loop (4 strategies)
│ ├── rag-server.js # RAG poisoning (3 poisoned docs)
│ ├── threshold-server.js # Context window poisoning (8 levels)
│ ├── schema-confusion-server.js # Schema confusion (5 tools)
│ ├── test-*.js # Test harnesses for each vector
│ └── test-full-chain.js # 4-server integration test
├── logs/ # Detailed findings per attack
│ ├── index.md # Executive summary + master index
│ └── 01-*-*.md # Individual attack reports
├── docs/
│ ├── specs/ # Design specs
│ └── plans/ # Implementation plans
├── scripts/
│ └── generate-report.mjs # PDF report generator (Puppeteer)
└── screenshots/ # Attack demo screenshots
```
## Scope
| Dimension | Value |
|-----------|-------|
| **Clients tested** | opencode (Claude models), Kilo Code |
| **Transport** | stdio (JSON-RPC 2.0) |
| **OS** | Windows 11 (10.0.26200) |
| **Protocol version** | 2024-11-05 |
## Reports
Each attack has a full writeup in `logs/`:
| # | Finding | Report |
|---|---------|--------|
| 01 | Prompt injection (11 strategies) | [`logs/01-prompt-injection.md`](logs/01-prompt-injection.md) |
| 02 | Privilege inheritance | [`logs/02-privilege-inheritance.md`](logs/02-privilege-inheritance.md) |
| 03 | Tool poisoning | [`logs/03-tool-poisoning.md`](logs/03-tool-poisoning.md) |
| 04 | Cross-server lateral movement | [`logs/04-cross-server-lateral-movement.md`](logs/04-cross-server-lateral-movement.md) |
| 05 | Supply chain | [`logs/05-mcp-supply-chain.md`](logs/05-mcp-supply-chain.md) |
| 06 | Agentic loop attacks | [`logs/06-agentic-loop-attacks.md`](logs/06-agentic-loop-attacks.md) |
| 07 | RAG poisoning | [`logs/07-rag-poisoning.md`](logs/07-rag-poisoning.md) |
| 08 | Context window poisoning | [`logs/08-context-window-poisoning.md`](logs/08-context-window-poisoning.md) |
| 09 | Tool schema confusion | [`logs/09-tool-schema-confusion.md`](logs/09-tool-schema-confusion.md) |
## License
**Alethia Research** — Uncovering Truth , at a time.
