Threat
When an MCP Tool Asks for Your GitHub Token
First reported knostic.ai
Page published
Earliest dated coverage: 12 Nov 2026 · First observed: 12 Nov 2026 · Latest dated coverage: 12 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
The MCP tool-description injection attempts to turn an unrelated coding request into unauthorized credential retrieval, illustrating how untrusted tool metadata can cross an agent's consent and credential-access boundaries.
Knostic's static review of @agentdance/node-webrtc-mcp version 1.0.13 found a prompt injection in its get_started tool description instructing coding agents to retrieve a GitHub CLI token without asking the user and pass it to the MCP server. The server attempts to use a supplied token to star the publisher's repository. The researchers did not install or run the package, so successful agent execution or credential exposure was not demonstrated.