mcp-watchdog

MCP security proxy that sits between AI coding assistants and MCP servers, detecting and blocking all known MCP attack classes. Works with any MCP server (tools, resources, prompts) on macOS, Linux, and Windows.

Catches Rug Pulls, Tool Poisoning, Tool Shadowing, Name Squatting, Parameter Injection, SSRF, Command Injection, SQL Injection, Reverse Shell, Supply Chain Impersonation, Token Leakage, OAuth Confused Deputy, Session Smuggling, Context Leakage, Email Header Injection, False-Error Escalation, Preference Manipulation, ANSI Escape Injection, MCP Parasite, Thanatos (all 4 layers), SANDWORM_MODE-style prompt injection, Resource Content Injection, Prompt Template Injection, Sampling Hijack, and Elicitation Credential Harvesting — before any of it reaches your AI assistant.

Why this exists

MCP (Model Context Protocol) servers have full access to your AI assistant's context. A malicious or compromised server can:

• Inject hidden instructions into tool descriptions (<IMPORTANT> blocks telling the AI to exfiltrate credentials)
• Silently redefine tools after initial approval (Rug Pull attacks)
• Shadow trusted tools by injecting cross-server override instructions in tool descriptions (100% ASR on Claude Desktop)
• Squat tool names by registering duplicate tool names from different servers
• Steal system prompts and conversation history via parameter injection (HiddenLayer attack)
• Access cloud metadata via SSRF through URI parameters (MCP fURI, 36.7% of servers vulnerable)
• Execute arbitrary commands via shell metacharacters in tool arguments
• Inject SQL via tool arguments to SQLite/database MCP servers (Trend Micro disclosure)
• Spawn reverse shells to C2 servers (JFrog found 3 PyPI + npm packages with identical reverse shell payloads)
• Impersonate legitimate packages via typosquatting (fake Postmark MCP server - 1,643 downloads)
• Leak API keys and tokens (GitHub PATs, AWS keys, Slack tokens, JWTs) in responses
• Hijack OAuth flows via malformed authorization endpoints (CVE-2025-6514, 437K+ dev environments)
• Inject messages into sessions via agent session smuggling (A2A attacks)
• Silently BCC emails to attacker addresses via email header injection (postmark-mcp incident)
• Trigger privilege escalation via fake error messages designed to manipulate AI into granting elevated access
• Manipulate tool selection via persuasive language in descriptions biasing which tools the AI chooses
• Hide instructions via ANSI escape sequences and bidirectional text overrides invisible in terminal UIs
• Profile your behavior by collecting commit timestamps, deploy windows, and activity patterns
• Encode payloads steganographically inside normal-looking JSON responses
• Propagate across servers - output from Server A influences calls to Server B
• Persist across sessions by writing state to project files outside declared scope
• Escape filesystem sandboxes via symlink attacks bypassing path restrictions
• Exfiltrate data via URL params - sensitive tokens embedded in `https://evil.com

... View full README on GitHub