{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1513",
  "slug": "shadow-mcp-servers-security-gap",
  "edition": "2026-11-13T00",
  "url": "https://hangingcontext.com/stories/2026-11-13/shadow-mcp-servers-security-gap/",
  "newsroom": "artificial-intelligence",
  "beat": "developers",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Shadow MCP servers are the new shadow IT: installed in one command, trusted with full credentials, barely overseen.",
  "headline": "Shadow MCP servers are the new shadow IT",
  "dek": "Engineers are connecting AI agents to company systems through MCP servers and agent skills installed outside any approval process. Security researchers report thousands of malicious skills, exposed servers, and a real case of a compromised package that copied emails to an outside server.",
  "published_at": "2026-11-13T00:53:20Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 4 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 4,
  "publishers": [
    "jetstream-security-insights",
    "knostic-blog",
    "noma-security-blog",
    "serval-blog"
  ],
  "sources": [
    "jetstream-security-insights",
    "knostic-blog",
    "noma-security-blog",
    "serval-blog"
  ],
  "distinct_source_count": 4,
  "key_facts": [
    {
      "text": "An audit of 2,857 skills on ClawHub identified 341 overtly malicious packages, Noma reports, and 36.8% of 4,000 public agent skills contained exploitable security flaws, with 13.4% carrying critical remote execution or exfiltration vulnerabilities.",
      "cites": [
        {
          "claim_ids": [
            "1794518812044898856",
            "1794518812046898857",
            "1794518812043898855"
          ],
          "manifest_id": "1794518521440893524"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Over 1,800 MCP instances were discovered exposed directly to the public web, and 100% of tested MCP endpoints enumerated their full tool catalogs to unauthenticated, external queries, according to Noma.",
      "cites": [
        {
          "claim_ids": [
            "1794518812048898858",
            "1794518812050898859"
          ],
          "manifest_id": "1794518521440893524"
        }
      ],
      "self_reported": true
    },
    {
      "text": "The postmark-mcp package on npm was compromised in version 1.0.16 to blind-copy outbound communications to an external server, and the malicious package was downloaded 1,643 times before deletion.",
      "cites": [
        {
          "claim_ids": [
            "1794518812041898854"
          ],
          "manifest_id": "1794518521440893524"
        },
        {
          "claim_ids": [
            "1794510709157845486",
            "1794510709160845487"
          ],
          "manifest_id": "1794510311211843948"
        }
      ],
      "self_reported": true
    },
    {
      "text": "A published MCP server's tool instructs AI agents to obtain a GitHub token without user consent, using the gh auth token command to extract the GitHub CLI authentication token, Knostic reports.",
      "cites": [
        {
          "claim_ids": [
            "1794506476447806737",
            "1794506476449806738"
          ],
          "manifest_id": "1794506215807805245"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Serval says third-party MCP servers should undergo the same vendor review as other software, and requires OAuth 2.1 authentication for every MCP connection.",
      "cites": [
        {
          "claim_ids": [
            "1794527634723954665",
            "1794527634725954667"
          ],
          "manifest_id": "1794527388592953856"
        }
      ],
      "self_reported": true
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Installed in one command, trusted with everything",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794518812034898850",
                "1794518812038898852"
              ],
              "manifest_id": "1794518521440893524"
            }
          ],
          "markdown": "Shadow MCPs and agent skills represent the next phase of the operational evolution of shadow IT, according to Noma Security. Connecting an MCP server or installing an agent skill bypasses enterprise change-control pipelines and procurement checkpoints, because a developer types one command and the agent gains a new tool. The Model Context Protocol provides a standard way to connect AI agents to real systems, and MCP consists of a host, a client and a server, so the plumbing is simple by design. That simplicity is the risk."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794518812036898851"
              ],
              "manifest_id": "1794518521440893524"
            },
            {
              "claim_ids": [
                "1794510709182845499"
              ],
              "manifest_id": "1794510311211843948"
            }
          ],
          "markdown": "Shadow MCP servers and agent skills operate as active execution engines that inherit the full credentials and local access privileges of the deploying engineer, and local MCP servers run with the same privileges as the client. An MCP server is not a document the agent reads. It is code the agent can run, with the engineer's keys, files and network access behind it. Developers often install MCP servers from public registries using single commands, and MCP servers supply tool names, descriptions, input schemas and results to the model, which means the model takes instructions from whatever the server tells it."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794518812056898863"
              ],
              "manifest_id": "1794518521440893524"
            }
          ],
          "markdown": "Traditional security tools like EDR, CASB and SCA fail to monitor agentic threats because they operate within local socket pipes, loopback calls and stdio. The traffic never leaves the machine in a way those tools watch, so the usual safety net has a hole exactly where agents operate."
        }
      ]
    },
    {
      "heading": "The registries are already poisoned",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794518812044898856",
                "1794518812046898857",
                "1794518812043898855"
              ],
              "manifest_id": "1794518521440893524"
            }
          ],
          "markdown": "An audit of 2,857 skills on ClawHub identified 341 overtly malicious packages, and 36.8% of 4,000 public agent skills contained exploitable security flaws, with 13.4% carrying critical remote execution or exfiltration vulnerabilities. Public registries for agent skills are targeted with typo-squatted packages and malicious pre-install hooks, so the danger is not hypothetical. Roughly a third of public skills have a flaw an attacker can use, and about one in eight has a flaw that lets an attacker run code or steal data."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794518812041898854"
              ],
              "manifest_id": "1794518521440893524"
            },
            {
              "claim_ids": [
                "1794510709155845485",
                "1794510709157845486",
                "1794510709160845487"
              ],
              "manifest_id": "1794510311211843948"
            }
          ],
          "markdown": "The postmark-mcp package on npm was compromised in version 1.0.16 to blind-copy outbound communications to an external server. Security researchers reported in September 2025 that the postmark-mcp npm package copied a legitimate server, and the malicious package was downloaded 1,643 times before deletion. Version 1.0.16 of postmark-mcp added a line to blind-copy emails to an external address. A package that looked like a trusted email tool was quietly sending copies of everything it handled to someone else, and 1,643 installs happened before anyone stopped it."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794506476444806736",
                "1794506476447806737",
                "1794506476449806738"
              ],
              "manifest_id": "1794506215807805245"
            }
          ],
          "markdown": "Knostic found a smaller, sharper example: a published MCP server, @agentdance/node-webrtc-mcp version 1.0.13, contains a prompt injection in its get_started tool description. The tool instructs AI agents to obtain a GitHub token without user consent, and uses the gh auth token command to extract the GitHub CLI authentication token. If a token is obtained, the server attempts to star the agent-dance/node-webrtc repository. The starring action is not required for the tool's primary function of generating WebRTC starter code, which makes the token grab look like a test of what agents will hand over when a tool description tells them to."
        }
      ]
    },
    {
      "heading": "The attack surface grows with every tool",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794527634712954658",
                "1794527634717954661",
                "1794527634718954662"
              ],
              "manifest_id": "1794527388592953856"
            }
          ],
          "markdown": "Connecting an AI agent to more tools increases the potential attack surface, and prompt injection can influence which tools an LLM calls. Tool poisoning involves hiding malicious instructions in tool metadata, so the poison arrives inside the tool description itself, the part of the system the model is supposed to trust. Invariant Labs demonstrated tool shadowing, where a malicious server changes how an agent uses a trusted server, and Microsoft's Defender Experts team documented a case where an agent's tool combination created a security weakness."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794510709150845483",
                "1794510709168845491"
              ],
              "manifest_id": "1794510311211843948"
            },
            {
              "claim_ids": [
                "1794518812048898858",
                "1794518812050898859"
              ],
              "manifest_id": "1794518521440893524"
            }
          ],
          "markdown": "MCP servers can execute startup commands that download packages and exfiltrate SSH keys, and local MCP servers retrieve credentials from the environment rather than using OAuth 2.1 flows. Remote MCP servers introduce a third-party security dependency, and over 1,800 MCP instances were discovered exposed directly to the public web, with 100% of tested MCP endpoints enumerating their full tool catalogs to unauthenticated, external queries. An exposed server tells any stranger exactly what tools it offers, and then the stranger can try them."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794527634720954663"
              ],
              "manifest_id": "1794527388592953856"
            },
            {
              "claim_ids": [
                "1794510709162845488"
              ],
              "manifest_id": "1794510311211843948"
            },
            {
              "claim_ids": [
                "1794510709164845489"
              ],
              "manifest_id": "1794510311211843948"
            }
          ],
          "markdown": "Authentication is not authorization in MCP server interactions, and the MCP specification warns against publishing omnibus scopes like admin:* and files:*. OWASP classifies software supply chain attacks and dependency tampering in MCP as MCP04. The message from the standards side is consistent: knowing who connected is not the same as deciding what they may do, and a server that asks for everything should be treated as a risk, not a convenience."
        }
      ]
    },
    {
      "heading": "What good control looks like",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794527634723954665",
                "1794527634727954668",
                "1794527634725954667",
                "1794527634721954664"
              ],
              "manifest_id": "1794527388592953856"
            }
          ],
          "markdown": "Third-party MCP servers should undergo the same vendor review as other software, Serval argues, and Serval MCP tool calls are governed by the same RBAC layer as its REST API. Serval requires OAuth 2.1 authentication for every MCP connection, uses OAuth for user connections to eliminate credential copying, and returns a 403 error for unauthorized MCP tool calls. The pattern is to route agent tool calls through the identity and permission layers the company already has, rather than letting agents connect directly."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794518812058898864"
              ],
              "manifest_id": "1794518521440893524"
            }
          ],
          "markdown": "The MCP Security Specification mandates explicit command visualization and scoped approval prior to server registration. In plain terms: show the engineer what the server will run, and approve only the narrow permissions it needs, before it is registered. That is the control that would have caught the poisoned packages, the token grab and the exposed servers, if anyone had applied it."
        }
      ]
    }
  ],
  "unresolved": [
    "How many shadow MCP servers are already running inside enterprises that have not inventoried them",
    "Whether registries will add vetting or whether enterprises must block unreviewed installs",
    "How the MCP Security Specification's approval rules will be enforced in practice"
  ],
  "decision_card": {
    "not_for": [
      "Installing MCP servers from public registries without review",
      "Treating authentication as authorisation"
    ],
    "useful_for": [
      "Teams rolling out MCP servers to developers",
      "Security teams setting agent tool policy"
    ],
    "compare_against": [
      "Serval's RBAC-governed MCP routing",
      "Noma's shadow MCP controls"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-13T00"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794518521440893524",
    "1794510311211843948",
    "1794506215807805245",
    "1794527388592953856"
  ],
  "manifests": [
    {
      "title": "Who Approved That? Taking Control of Shadow MCPs and Skills",
      "source_url": "https://noma.security/blog/who-approved-that-taking-control-of-shadow-mcps-and-skills",
      "manifest_id": "1794518521440893524",
      "source_name": "noma-security-blog",
      "published_date": "2026-11-12"
    },
    {
      "title": "6 Questions to Ask Before You Connect to an MCP Server",
      "source_url": "https://jetstream.security/insights/mcp-server-security-questions",
      "manifest_id": "1794510311211843948",
      "source_name": "jetstream-security-insights",
      "published_date": "2026-11-12"
    },
    {
      "title": "When an MCP Tool Asks for Your GitHub Token",
      "source_url": "https://knostic.ai/blog/when-an-mcp-tool-asks-for-your-github-token",
      "manifest_id": "1794506215807805245",
      "source_name": "knostic-blog",
      "published_date": "2026-11-12"
    },
    {
      "title": "How enterprise teams should manage MCP server security risks",
      "source_url": "https://serval.com/blog/mcp-server-security-risks",
      "manifest_id": "1794527388592953856",
      "source_name": "serval-blog",
      "published_date": "2026-11-12"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794518521440893524",
      "1794510311211843948",
      "1794506215807805245",
      "1794527388592953856"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794518521440893524",
      "all": "for id in 1794518521440893524 1794510311211843948 1794506215807805245 1794527388592953856; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-13/shadow-mcp-servers-security-gap/",
    "json": "https://hangingcontext.com/stories/2026-11-13/shadow-mcp-servers-security-gap/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-13/shadow-mcp-servers-security-gap/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-13T00/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-15/ai-prs-broke-open-source-review/",
      "headline": "AI writes the code now. Humans can't read it fast enough — and open source just proved it",
      "slug": "ai-prs-broke-open-source-review"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-15/agents-claim-work-they-never-did/",
      "headline": "Agents claim work they never did. Now we can count how often",
      "slug": "agents-claim-work-they-never-did"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/inference-throughput-race-kimi-deepseek/",
      "headline": "Throughput is the new model spec, and the gap between hosts is now fortyfold",
      "slug": "inference-throughput-race-kimi-deepseek"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/coding-agent-orchestration-three-patterns/",
      "headline": "Coding agents split three ways, and the choice is now about control, not capability",
      "slug": "coding-agent-orchestration-three-patterns"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Connect your agent over MCP",
    "text": "Add https://mcp.synorb.com/mcp to your agent, then call the tool synorb-get-demo-key if it has no key yet. It needs no email and no form. Keys are free for 72 hours, and new keys are limited per network.",
    "cta": {
      "label": "How to connect",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-13/shadow-mcp-servers-security-gap/"
  }
}