Answer
What is an MCP supply chain attack?
An MCP supply chain attack arrives through a server or skill you chose to install, rather than a flaw in code you wrote. The attacker controls the package, the instruction file or the name, and the agent runs it with the access you granted.
What are the common shapes?
- A malicious skill. The instruction file carries a download, an obfuscated command or a hidden instruction. The public research confirmed 76 payloads and found password-protected archives used to evade scanners.
- A lookalike name. A package is one or two characters from the real one, and an agent or a hurried developer accepts it. The MCP ecosystem has the same name-trust problem as npm.
- A rug pull. A tool definition changes after approval. The OWASP MCP guidance tells teams to pin reviewed tool definitions by hash and review the change.
- An over-permissioned server. The server can delete or write production data, and the agent has no reason to hesitate. The PocketOS case in the episode is the example.
- A toxic flow. The skill reads untrusted content and can act on it, so whoever can edit that content can steer the agent.
Why does the manifest catch it?
Every shape leaves a trace in the manifest: a source, a version, a scope, a sandbox field, an identity, a package name, a log setting, an instruction body. The check reads those traces and names the rule. It cannot prove the publisher is honest, and it says so.
What should a team do first?
Inventory, then approve, then enforce. Inventory is the paste. Approval is the verdict and the dated note. Enforcement is the allowlist or the fleet platform, which needs the first two to be worth configuring.
Source note. The attack shapes are drawn from the OWASP MCP Security Cheat Sheet, the MCP security best practices page and the Snyk ToxicSkills audit. All sources.