Skip to main content
Using MCP servers from untrusted or malicious sources.

​
How to resolve

  • Source verification: Only install MCP servers from trusted, verified sources such as official repositories, vetted vendors, or internally developed and reviewed code. Implement a software approval process that includes security review, vulnerability scanning, and source code audit for third-party MCP servers. Consider implementing a private package repository with approved MCP servers.
  • Server versioning: Pin server versions explicitly in configuration or dependency files to prevent automatic updates to potentially compromised versions.
  • Code integrity: Verify cryptographic signatures on server packages before installation.
  • Server inventory: Maintain an inventory of all deployed MCP servers including their sources, versions, and trust status.
  • Vulnerability detection and patch management process: Subscribe to security advisories and vulnerability databases relevant to your MCP servers. Implement a patch management process to update servers when vulnerabilities are disclosed while maintaining version control. Use software composition analysis (SCA) tools to detect known vulnerabilities in dependencies.

​
Risk

Governance/Compliance Supply chain vulnerabilities violate multiple security standards:
  • NIST SP 800-161 Rev.1 (Cybersecurity Supply Chain Risk Management): Violates supply chain risk management practices by not verifying integrity, provenance, and security of MCP server dependencies.
  • OWASP MCP Top 10 (MCP04:2025 - Software Supply Chain Attacks & Dependency Tampering): Enables software supply chain attacks through compromised or tampered MCP server packages and dependencies.
Security Supply chain attacks targeting MCP servers are particularly dangerous because these servers have privileged access to LLM applications, sensitive data, and connected systems. Malicious MCP servers can exfiltrate data, inject backdoors, manipulate LLM responses, execute arbitrary code, or establish persistent access to compromised environments. Vulnerable server versions may contain exploitable bugs that allow remote code execution, authentication bypass, or privilege escalation. Without version pinning, automatic updates can introduce compromised versions without user awareness. The risk is amplified by the MCP ecosystem’s distributed nature, where servers from multiple sources may be integrated into a single application, creating multiple potential compromise vectors.

​
Explanation

MCP servers are installed from untrusted sources or known-vulnerable versions of such servers are detected. MCP servers may be intentionally malicious, backdoored, or contain unpatched security vulnerabilities that can be exploited to compromise the LLM application and connected systems.

​
Specifications

Trigger
  • MCP server scan detects servers from untrusted or unverified sources, known-vulnerable server versions, lack of version pinning, or missing signature verification.
Severity
  • HIGH
Applies to: MCP Server