Owasp MCP

title: 'MCP09: Shadow MCP Servers' description: OWASP MCP Top 10 reference for shadow server vulnerabilities including unapproved MCP deployments and governance bypass patterns

09 Shadow MCP Servers

Identifier: MCP09:2025 Category: Governance

Description

Shadow MCP Servers are unapproved or unsupervised deployments of Model Context Protocol instances operating outside the organization's formal security governance. These rogue MCP nodes are spun up by developers, research teams, or data scientists for experimentation, testing, or convenience, frequently using default credentials, permissive configurations, or unsecured APIs. MCP servers expose sensitive capabilities such as data retrieval, tool execution, or model control. Unsanctioned deployments become invisible backdoors into enterprise systems, bypassing centralized authentication, monitoring, and data governance controls.

Impact

• Sensitive data processed by rogue MCPs may be accessed or exfiltrated.

• Shadow servers create unmonitored endpoints vulnerable to RCE, injection, or context poisoning.

• Violations of internal governance and external regulations (GDPR, PCI DSS, SOC 2).

• Inconsistent security posture with missing patches or weak defaults.

• Untracked servers delay containment and forensics during security incidents.

• Unsanctioned plugins can introduce malicious dependencies into production pipelines.

Vulnerability checklist

• Teams can deploy MCP servers without central registration or security review.

• No asset inventory or endpoint discovery process exists for internal APIs.

• Network monitoring shows unauthorized services on unusual ports (8000, 8080).

• No automated MCP discovery scan covers subnets or cloud environments.

• MCP configurations are managed independently by individual teams.

• No governance or change management workflow exists for new AI infrastructure.

• Developers use test environments connected to production data sources.

Prevention controls

1. Create a centralized MCP registry where every instance must be registered before deployment.

2. Tie registration to CI/CD pipelines so unregistered instances fail deployment.

3. Maintain metadata per instance (owner, purpose, version, endpoints, compliance state).

4. Use network discovery tools to detect open MCP ports and endpoints.

5. Deploy passive network sensors to identify MCP traffic patterns.

6. Publish secure-by-default MCP configuration templates.

7. Require all instances to integrate with central IAM providers (SSO, LDAP, OIDC).

8. Apply network segmentation (VPC-level controls, firewall rules).

9. Correlate telemetry to identify MCP-related API traffic from unknown hosts.

10. Include MCP registration requirements in development onboarding documentation.

Example attack scenarios

Scenario A — Internal exposure via indexing

A developer's test MCP instance is indexed by an internal search engine. Another user discovers unprotected APIs and downloads customer datasets.

Scenario B — External compromise

A shadow MCP on a cloud VM uses an outdated framework version. Attackers exploit the vulnerable endpoint and plant a backdoor that spreads laterally.

Scenario C — Plugin supply chain contamination

A research team installs experimental plugins from GitHub into their shadow MCP. The plugin uploads API keys to an external C2 server.

Scenario D — Data poisoning through unvetted connectors

A rogue MCP pulls experimental data from an external partner API. Manipulated entries propagate into model retraining pipelines, corrupting production outputs.

Detection signals

• Unregistered hosts exposing /mcp or similar routes.

• Unknown or self-signed certificates in network scans.

• Anomalous outbound traffic from R&D subnets.

• MCP API patterns detected in unexpected network zones.

• Agents invoking unknown or duplicate MCP endpoints.

Remediation

• Contain detected shadow MCPs (disable network access, snapshot for forensics).

• Identify owners and isolate associated credentials or API keys.

• Review logs and assess data exposure or leakage.

• Remove unapproved plugins, schemas, or connectors.

• Enforce registration and compliance checks before re-enabling access.