Hunt Agent MCP Supply Chain

An MCP-connected agent trusts the tools it loads — their names, descriptions, schemas, and results — as much as its own system prompt. That trust is a supply chain: a malicious or compromised server, a mutated tool, or a poisoned registry entry turns the agent against its user. This is not hunt-agent-mcp-exposure (that probes what an exposed server leaks); here the server/tool is the attacker, and the agent is the victim carrying attacker instructions with the user's privileges.

The discipline mirrors prompt-injection: a tool description/result that CONTAINS instructions is INFO; the agent EXECUTING them toward a real sink is the finding. Score by the sink.

Where This Lives / Attack Surface Signals

Any agent loading third-party/community MCP servers; multiple servers in one context (cross-server shadowing surface); dynamic tool loading (definitions fetched at runtime); no manifest pinning/signing; OAuth tokens shared across servers. Signals: tool descriptions with imperative language ("always…", "before any tool, first…"), tools whose behavior changed since install, near-duplicate tool names.

Crown Jewel Targets

• Rug-pull: a tool approved as benign silently changes its definition/behavior after trust is granted (TOFU with no re-verification).
• Cross-server shadowing: a malicious server's tool description manipulates how the agent uses a different, trusted server's tools.
• Confused-deputy via tool: a malicious tool uses the agent's credentials/scopes to reach data/actions the attacker couldn't directly.