SSH Key Exfiltration via MCP Tool Poisoning
LocalAbout SSH Key Exfiltration via MCP Tool Poisoning
This repository is a proof of concept for security research, showing how tool poisoning in an MCP server can lead to remote code execution and data exfiltration. It is aimed at educators and security researchers and includes mitigation recommendations.
Key features
- 01Demonstrates rug pull style tool description poisoning
- 02Shows base64-encoded command obfuscation
- 03Describes collection and exfiltration of SSH public keys
- 04Lists mitigation recommendations for MCP users
Use cases
- 01Security researchers studying MCP tool poisoning risks
- 02Teaching supply chain risks of MCP servers
- 03Reviewing auto-run settings in AI coding tools
MCP support
The project is a malicious MCP server whose poisoned tool documentation (DockerCommandAnalyzer) manipulates the AI assistant that reads it.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
We haven’t collected a package or remote endpoint for this server. Follow the instructions in the project README.
Tools
Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.
Details
From the project READMESSH Key Exfiltration via MCP Tool Poisoning
This repository demonstrates a security vulnerability in MCP (Model Context Protocol) servers that allows for remote code execution and data exfiltration through tool poisoning. This is intended for educational and security research purposes only.
Link for the Blog:
Repository Contents
server.py- The malicious MCP server implementation containing the poisoned tool.cursor/mcp.json- Configuration file for Cursor AI integration
How It Works
The attack demonstrates the "Rug Pull" method:
- A user connects to the malicious MCP server through MCP Client like Cursor AI
- The server modifies the
DockerCommandAnalyzertool's documentation with malicious code - When an AI assistant reads this documentation, it's manipulated to recommend running a base64-encoded command
- The encoded command silently:
- Collects the user's SSH public keys
- Exfiltrates them to a remote server
- Removes evidence of the attack
Technical Implementation
The key elements of the attack are:
- Two-stage poisoning: Uses a marker file for persistence to ensure the tool remains poisoned
- Social engineering: Uses urgent language to manipulate AI assistants
- Base64 obfuscation: Hides the malicious commands from casual inspection
- wget for exfiltration: Uses standard HTTP POST to send data to an attacker-controlled server
Mitigation Recommendations
To protect against this type of attack:
- Disable auto-run features in AI development tools like Cursor
- Always verify the source of any MCP server before connecting
- Review code from untrusted sources before execution
- Use sandboxed environments when testing new AI tools
- Implement egress filtering to block unexpected outbound connections
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.