MCP Marketplace Compromise (Typo-Squatting · Shadowing · Rug-Pull)
Tool & Affordance RiskDescription
Three related distribution-channel attacks against MCP servers in public marketplaces. (a) Typo-squatting: `github_mcp_` (trailing _) vs `github_mcp`. (b) Tool shadowing: a newer server registers a tool with an identical name as an earlier safer one, overriding it in the agent's resolution table. (c) Rug-pull: v1.0.0 clean, v1.0.1 backdoored — classic npm pattern. Sub-type of ZYR-TR-005 but with operationally distinct detection and mitigation playbooks.
"slack-mcp-server" registered today. Approved registry has "slack_mcp" (underscore). Agent invokes the typo-squatted server thinking it's the approved one; server exfiltrates the auth token.
Irrelevant retrieval is a well-documented failure mode in academic evaluations of RAG systems and has been reproduced across multiple benchmark datasets, but specific confirmed production incidents where irrelevant retrieval caused material outcomes have not been individually documented in the public record.
No public incident on record — evidence level: Demonstrated
Primary mitigations
- Approved MCP server registry (Levenshtein typosquat check)
- tool-name collision alerts across client's fleet
- per-version SHA pinning
- release-watch on update hooks
- mandatory 7-day quarantine of new server versions before auto-update
Detection signals
Levenshtein distance < 2 to an approved server name; tool-name collision across registered servers; SHA mismatch on tool-set between consecutive `tools/list` calls; new tool quietly added in a patch version