What is a Malicious MCP Server?

Not every MCP server is built in good faith. A malicious MCP server is purpose-built to exploit agents that connect to it. Unlike a compromised server (which started legitimate and was later attacked), a malicious server is adversarial from inception.

The attack surface is broad. A malicious server can poison tool descriptions with hidden instructions (tool poisoning), return manipulated data that influences agent behaviour (indirect injection), log every parameter the agent sends (passive exfiltration), or execute harmful operations on its own infrastructure while returning success responses to the agent.

Distribution often mirrors malware distribution patterns. The malicious server may be advertised in community forums, MCP server directories, or GitHub repositories as a useful tool. It might genuinely provide functionality — a working database connector, a functional API wrapper — while silently performing malicious operations alongside.

The threat is amplified by the trust model of most MCP clients. Once a server is added to the configuration, all its tools are available to the agent with equal trust. There is no graduated trust model, no capability sandboxing, and no runtime verification of server behaviour in the base protocol.

Intercept enforces zero-trust policies on all MCP servers regardless of origin. Every tool call passes through YAML-defined rules — tool allowlists restrict which tools from each server the agent can invoke, argument validation blocks suspicious parameters, and rate limiting prevents bulk data exfiltration. Even if a malicious server is connected, Intercept constrains what the agent can do through it to only the explicitly permitted operations.