All categories

MCP Exploitation

Attacks specific to Model Context Protocol servers, including filesystem, network, and shell tool abuse.

OWASP LLM: LLM06, LLM03high: 6critical: 2
highLLM06

Filesystem read out-of-bounds

MCP filesystem server allows reads outside the configured project root via path traversal.

highLLM06

Filesystem write overwrites config

MCP filesystem server allows writes that overwrite agent config files, persisting injection across sessions.

criticalLLM06

Shell server arbitrary exec

MCP shell server runs commands without sandboxing. Attacker pivots from injection to RCE.

highLLM03

MCP server supply chain

Attacker publishes a useful-looking MCP server; victims install it and grant it access to local files and tools.

highLLM01

MCP message confusion

Untrusted content reaches the agent through an MCP server that does not properly delineate user vs tool-output messages.

criticalLLM02

Credentials via env tool

MCP server that exposes environment variables as a 'tool' lets the agent read deploy-time secrets.

highLLM01

MCP injection via resource

MCP resources (files exposed by a server) contain injection payloads; agents that auto-load resources are compromised.

highLLM03

Tool shadowing

A second MCP server registers a tool with the same name as a built-in one, intercepting calls.