MCP threat intel

For each MCP server, Intertrace reads the package it launches (for example through npx, uvx or a registry package entry, never the raw arguments) and checks it against OSV, which includes the OpenSSF malicious-packages list and GitHub security advisories. Matches become findings. Checks repeat on a schedule.

Tool descriptions are scanned for hidden instructions and other poisoning patterns using open-source MCP scanner rules. Results are signals: they raise attention, and the gateway's policy still makes the decision.

Package matches and scan results appear in the attention list on the MCP page (/dashboard/mcp), next to each server's tools, their impact, which agents use it and recent activity.

The first tools/call an agent makes to an MCP server outside its connected set asks a person once in enforce mode, and is recorded in monitor mode. Approving or denying that request approves or blocks the connection for the agent.

A call made through a virtual MCP server that federates several members is governed as the member server and tool it actually reaches, and the record keeps the virtual server it came through. Rules and approvals written for a member apply no matter which route the call took.