A supply chain attack that abuses trust in Model Context Protocol distribution channels, registries, or repositories. The attacker replaces or clones a legitimate server with a malicious one, then uses false provenance signals to get it installed into developer or agent environments.
Expanded Definition
MCP supply chain poisoning is an attack against the software distribution path for Model Context Protocol components, where trust in a registry, repository, package reference, or mirrored server is abused to deliver a malicious replacement. In practice, the attacker may clone a legitimate MCP server, preserve familiar naming or metadata, and introduce hidden behavior that changes tool calls, exfiltrates secrets, or manipulates agent output.
Definitions vary across vendors because MCP is still an emerging standard and the surrounding ecosystem is evolving quickly. The security question is not only whether the package is signed, but whether provenance, maintainer identity, update channel, and runtime behavior all line up with a trustworthy source. That makes this term adjacent to software supply chain compromise, but narrower in that the target is the MCP trust path used by agents and developer tooling. Guidance from the OWASP Non-Human Identity Top 10 and the OWASP Agentic AI Top 10 both reinforce that identity, trust, and tool integrity must be treated as first-class controls for agentic systems.
The most common misapplication is treating an MCP server as safe because it appears in a familiar catalog or repository, which occurs when teams assume listing status is equivalent to verified provenance.
Examples and Use Cases
Implementing MCP distribution controls rigorously often introduces friction, requiring organisations to balance faster developer adoption against more verification steps for publishing and installation.
- A developer installs an MCP server from a cloned repository that uses the same name and description as the original, but the malicious copy redirects tool outputs and harvests API keys from environment variables.
- An internal agent platform auto-discovers MCP servers from an uncurated registry, then loads a poisoned update that adds hidden prompt injection and unauthorized data access.
- A vendor-maintained MCP package is replaced in transit or during repository compromise, similar in pattern to the incidents discussed in the Mastra npm Supply Chain Attack — Sapphire Sleet and the LiteLLM PyPI package breach.
- A CI pipeline pulls an MCP configuration artifact that references a legitimate name but a malicious endpoint, exposing build-time secrets and agent credentials before deployment.
- Teams using registry trust checks may still miss a poisoned server if they do not validate runtime behavior against the published manifest, a gap also seen in broader agentic risk patterns described by the OWASP Agentic Applications Top 10.
Why It Matters in NHI Security
MCP supply chain poisoning matters because agents and automation systems often run with persistent access, broad tool permissions, and privileged secrets. Once a poisoned MCP component is trusted, it can become an identity abuse point as much as a code compromise point. That is why NHI governance must include provenance checks, publisher identity verification, allowlisting, change control, and rapid revocation of compromised credentials.
The risk is not hypothetical. In The State of Secrets Sprawl 2026, NHIMG reports that 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, showing how quickly protocol adoption can turn into credential exposure at scale. That same research also shows that 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, which is exactly why poisoned MCP artifacts can propagate so efficiently through automated environments. The 52 NHI breaches Report shows how often identity compromise and supply chain abuse reinforce each other in real incidents.
Organisations typically encounter the true impact only after an agent starts behaving as an untrusted operator, at which point MCP supply chain poisoning becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Trusting MCP distribution paths is an NHI identity and provenance problem. |
| OWASP Agentic AI Top 10 | A2 | Agent toolchains can be subverted through poisoned context and plugins. |
| NIST CSF 2.0 | PR.DS-6 | Software integrity and authenticity controls directly reduce supply chain poisoning risk. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero trust limits implicit trust in repositories, registries, and agent tools. |
| NIST AI RMF | AI risk management covers provenance, misuse, and downstream harm from poisoned tools. |
Verify publisher identity, provenance, and runtime integrity before allowing MCP components into production.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
