MCP supply chain attacks are coming — here's how to prepare

The npm incident, but for AI agents

Remember when malicious npm packages stole crypto wallets? The same thing is coming for MCP servers.

An MCP server runs with full access to:

• Your filesystem (~/.ssh/id_rsa, ~/.aws/credentials)


• Your network (exfiltrate data)


• Your environment variables (API keys, tokens)


• Process spawning (run arbitrary commands)

There's no sandboxing. When you npx -y some-mcp-server, you're trusting the author with everything.

What we found auditing 8,764 servers

At .