AI Platform / Security
Untrusted tools from an MCP marketplace
A team lets its agents install and call third-party MCP tools — code shipped by unknown vendors and updated on the vendor’s schedule, not yours.
Real example — shipping today
source →Anthropic · Model Context Protocol (MCP)
MCP opened an ecosystem of third-party tool servers any agent can discover and call — powerful, and a live software-supply-chain surface when the tool is code you didn’t write.
The danger without a gate
A malicious or silently-updated tool exfiltrates data, calls a hidden destructive endpoint, or impersonates a trusted tool — the supply-chain surface of an open, agent-driven tool ecosystem.
How MCPIP handles it, step by step
Read it top to bottom. Each step shows the real command and exactly what MCPIP returns — the same allow / step-up / denied envelope every time.
The untrusted tool lists what it can call — aliases only
When a third-party tool asks what’s available, MCPIP answers with opaque aliases. Real URLs, tables, and accounts never cross the wire.
POST /v1/mcp
{ "jsonrpc": "2.0", "method": "tools/list", "id": 1 }{
"jsonrpc": "2.0",
"id": 1,
"result": {
"tools": [
{ "name": "skill_finance_report_read" },
{ "name": "skill_finance_invoice_post" }
]
}
}attackThe attack: a call outside the grant
The tool tries to invoke a skill it was never granted. There’s no alias for it in this compartment, so it’s denied — opaquely, and written to the WORM log.
POST /v1/mcp
{ "jsonrpc": "2.0", "method": "tools/call", "id": 2,
"params": { "name": "skill_payroll_export", "arguments": {} } }{
"jsonrpc": "2.0",
"id": 2,
"error": { "message": "denied", "data": { "correlation_id": "f7b309aa" } }
}attackThe tool updates itself — and fails closed
MCPIP’s connector registry is hash-pinned. The moment the tool’s code drifts from the pinned hash, it stops working until an operator deliberately re-pins it. A silent update can’t sneak new behavior in.
The result
Agents use an open tool marketplace without granting untrusted code unlogged, unbounded reach.
The same flow, at a glance
Every command above runs against a local sandbox in one line.
run it yourself — curl … | bash && mcpip up →