Threat · curated 25 Jul 2026
MCP Config Poisoning: Text file to RCE - Checkmarx Zero
First reported checkmarx.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
MCP Configuration Poisoning shows that simply placing a text file in a repository can weaponize AI agent tooling and even security scanners into executing attacker code, exposing developers to full machine compromise.
Checkmarx Zero researcher Bruno Dias details MCP Configuration Poisoning, an attack where a malicious or modified mcp.json file embeds attacker-controlled commands and arguments that AI tools and agents execute when loaded. The write-up demonstrates how a security scanner processing a poisoned MCP config can be turned into a trigger for Remote Code Execution (RCE), referencing a vulnerability in Snyk's agent scan.
Summary
Checkmarx Zero disclosed a class of vulnerability dubbed MCP Configuration Poisoning, in which malicious mcp.json Model Context Protocol configuration files embed attacker-controlled commands that trusted AI tooling automatically executes when processing a repository, leading to Remote Code Execution with the privileges of the processing tool.[0]
As a concrete proof of concept, the researchers demonstrated RCE in Snyk's Agent Scan: scanning a project containing a crafted mcp.json runs the embedded shell command on the victim's machine. The issue was reported to Snyk, found to duplicate an earlier independent discovery, and has been fixed in Agent Scan version 0.5.0.[0][1]
Attack chain
- Delivery: An attacker gets a malicious mcp.json into a victim's environment — via a pull request into an existing project, a compromised dependency, or by publishing a legitimate-looking repository — without needing to exploit a bug in the tooling itself.[0]
- Trigger / Execution: A trusted tool (such as a security scanner) reads and processes the poisoned mcp.json, interpreting the attacker-controlled command and args fields and spawning the specified process, which runs the attacker payload on the host with the tool's privileges.[0]
Disclosure timeline
| Date | Event |
|---|---|
| July 23, 2026 | Checkmarx Zero published its writeup of MCP Configuration Poisoning and the Snyk Agent Scan RCE proof of concept, noting the issue was already fixed and previously disclosed.[0] |
How it works
MCP projects use a JSON file (typically mcp.json) with a top-level mcpServers object, where each server entry specifies a command (the executable launched, such as node, python, or bash), an args array of command-line arguments, and an env map of environment variables. Because command and args directly determine what executes on the host, a tool that loads and runs these fields without sandboxing, validation, or user confirmation provides a direct path to RCE.[0]
In the proof of concept, a repository contains an mcp.json defining a server with command 'bash' and args ['-c','whoami > pwned']. Running 'uvx snyk-agent-scan@latest scan ./malicious_project/mcp.json' causes the scanner to execute the embedded command, creating a 'pwned' file containing the output of whoami — confirming arbitrary command execution on the host.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Snyk Agent Scan (snyk-agent-scan) | Versions prior to 0.5.0 that process mcp.json configuration files | Fixed in version 0.5.0[0] |
Key takeaways
- Any tool that automatically trusts and executes configuration files from a repository it does not control — especially the command and args fields in mcp.json — creates a direct path to Remote Code Execution.[0]
- Developers should treat mcp.json the same way they would treat any other executable code when scanning or cloning repositories they do not fully trust, and should not blindly trust security tools in the AI ecosystem.[0]
Defensive actions
- Avoid executing commands straight from configuration files in tools that read MCP configs; if execution is necessary, sandbox subprocesses with reduced privileges and access.: The command and args fields in mcp.json carry inherent RCE risk when run without isolation, so restricting the spawned process limits the impact of a successful attack.[0]
- Detect and block suspicious patterns such as shell invocation or shell piping from URLs, and require an informed Human-in-the-Loop consent prompt hardened against Lies-in-the-Loop / HITL Dialog Forging before running commands.: Blocklists alone are incomplete, and naive HITL prompts can be forged, so layered controls are needed to reduce exploitation.[0]
- Treat mcp.json and other repository configuration files as potentially executable, untrusted code, and run tools against untrusted repositories inside a sandboxed environment such as a restricted Docker image.: Tools automatically process config files from repositories the user does not control, so isolating the whole execution environment cuts off a successful attack.[0]