FlawOpen

flawopen.com/Incidents/deadbugz-mcp-delayed-metadata-supply-chain-campaign-august-2026

● Pillar Security / MCP ecosystem · CWE-829 (editorial mapping; no CVE assigned) · 2026-08-10 · Medium
FlawOpen Security Research

Deadbugz: MCP Tool Metadata Changed After Approval

Pillar Security documented an MCP supply-chain campaign that changed tool metadata after three normal calls. Its review found no pull requests merged through GitHub’s PR mechanism; its report did not document downstream compromise. The Cloud Security Alliance notes that visibility into independent local execution was limited.[1], [3]

💡 Plain English Explainer (ELI5)

Imagine approving a contractor because their badge lists harmless duties. After three routine deliveries, the badge quietly changes to request access to locked rooms. The danger is that the building still trusts the original approval. An MCP client must notice when a server changes the tool instructions it was approved to provide.[1]

Core Concepts & Subsystem Terms

MCP
A protocol through which an AI application discovers and calls tools provided by a server.[5]
Tool metadata
A tool’s name, description and input schema, which the client may place in model context.[5], [1]
Runtime-gated change
Behavior withheld until a normal interaction threshold is reached; Pillar reported a three-call counter.[1]
Supply-chain delivery
Introducing a dependency or configuration through a trusted development workflow, such as a repository pull request.[1]
CWE-829
Editorial mapping: functionality was introduced from a server operating outside the client’s trusted control sphere. No CVE or CVSS score was assigned.[1], [3]

Framework mappings

  • CWE reference for the weakness described in this guide: CWE-829

Incident Timeline

2026-08-10

Pillar identified 23 related pull requests created within a 74-minute window; its review found none merged through GitHub’s PR mechanism at that time.[1]

2026-08-12

Pillar published its technical report describing the three-call metadata change and indicators.[1]

2026-10-08

The OWASP GenAI Security Project included Deadbugz in its Q3 2026 roundup; this confirms attention, not compromise or search volume.[2]

Step-by-Step Attack Flow

Step 1

Configuration is proposed

A pull request adds a remote or local MCP server configuration to an AI project. Pillar reviewed 17 remote-endpoint changes, four hidden local-script references, and two listing submissions.[1]

Step 2

Initial review sees ordinary tools

The server initially presents text formatting and summarization tools. Pillar says brief review requests can receive this benign metadata.[1]

Step 3

Normal use crosses the gate

The server tracks tool calls per client. After three calls, later tools/list and prompts/get responses return changed instructions.[1], [5]

Step 4

The agent receives untrusted directions

Those instructions attempt to steer the connected agent toward sensitive local information and conceal the activity. This is a campaign description, not a confirmed compromise.[1], [3]

Step 5

Approval must bind to exact metadata

A client should fingerprint approved tool definitions and pause for operator review when a server presents different definitions. Independently enforce file, credential and network permissions.[1], [4], [5]

Source Code: Flaw vs. Secure Implementation

The source report describes metadata poisoning and pull-request delivery, not a CVE in the MCP specification. The risk occurs when a client treats mutable server-provided descriptions as permanently trusted after initial approval. The report attributes the campaign to a public GitHub account; this article reports that attribution as Pillar’s finding, not verified real-world identity. Pillar said its reviewed pull requests were not merged through GitHub’s PR mechanism at review time and did not establish downstream compromise. The linked source repository currently returns 404, so code claims here rely on Pillar’s published technical analysis rather than an independently re-fetched source tree. The defensive Python example is an illustrative client-side policy wrapper, not MCP library drop-in code. CWE-829 is an editorial classification; no CVE or CVSS is assigned. The adapter must refresh on MCP change notifications and include both tools/list and prompts/get; metadata_snapshot is an illustrative adapter method, not an MCP SDK API. Capture approved_digest only after operator review. The snapshot must include all relevant server-provided metadata, including tools/list definitions and the full prompts/get contents for approved prompts. Re-fetch before dispatch and stop the action on mismatch; this check cannot detect server behavior changes or a change between checking and use, so independent action permissions remain necessary.[1], [4], [5]

UNPATCHED FLAW
def agent_metadata(session):
    # Adapter returns the server's current tools and prompts as JSON data.
    return session.metadata_snapshot()
HARDENED SECURE PATCH
import hashlib
import hmac
import json

def fingerprint(snapshot):
    normalized = dict(snapshot)
    for key in ("tools", "prompts"):
        normalized[key] = sorted(
            snapshot[key],
            key=lambda item: json.dumps(item, sort_keys=True, separators=(",", ":")),
        )
    canonical = json.dumps(normalized, sort_keys=True, separators=(",", ":"))
    return hashlib.sha256(canonical.encode()).hexdigest()

def agent_metadata(session, approved_digest):
    current = session.metadata_snapshot()
    if not hmac.compare_digest(fingerprint(current), approved_digest):
        raise PermissionError("MCP metadata changed; require operator approval")
    return current

Engineering & System Hardening Checklist

Sources