AIR Security's AI Agent Firewall and the Emerging MCP Threat Surface: A Defender's Guide to Securing AI Agents, Skills, and Plugins

---
title: MCP Server Process Spawning Shell or Script Interpreter
id: 8c4d2f91-3a7b-4e5c-b6d1-2f8a9c0e1b34
status: experimental
description: Detects MCP server processes (Node/Python-based MCP tooling) spawning shells, script interpreters, or download utilities — a strong indicator of a malicious or prompt-injected MCP server executing attacker-controlled instructions.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.securityweek.com/ai-agent-firewall-startup-air-security-emerges-from-stealth-with-50-million/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'mcp-server'
      - '@modelcontextprotocol'
      - 'mcp_server'
      - 'server-filesystem'
      - 'uvx'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - MCP servers legitimately wrapping CLI tools (audit and allowlist per-server)
level: high
---
title: AI Agent or MCP Configuration File Modification
id: 3e7b1a52-9d4c-4f8e-a2b6-7c1d5e9f0a23
status: experimental
description: Detects creation or modification of MCP and AI agent configuration files, which define which servers and tools an agent may invoke. Unauthorized changes can add malicious MCP servers or expand permissions.
references:
  - https://attack.mitre.org/techniques/T1565/001/
  - https://www.securityweek.com/ai-agent-firewall-startup-air-security-emerges-from-stealth-with-50-million/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1565.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'claude_desktop_config.json'
      - '\.mcp.json'
      - 'mcp_settings.json'
      - '\.cursor\mcp.json'
      - '\.vscode\mcp.json'
      - 'cline_mcp_settings.json'
      - 'continue_config.json'
falsepositives:
  - Developers legitimately adding MCP servers during tool setup
level: medium
---
title: Suspicious Package Manager Install of MCP Server Components
id: 5a9c3e17-2b8f-4d6a-9c4e-1f7b3d8a2e56
status: experimental
description: Detects npm/pip/uv installing MCP server packages from command lines on workstations or servers where AI agent tooling is not expected. Typosquatted or malicious MCP packages are a known supply chain delivery vector.
references:
  - https://attack.mitre.org/techniques/T1195/002/
  - https://www.securityweek.com/ai-agent-firewall-startup-air-security-emerges-from-stealth-with-50-million/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\npm.exe'
      - '\npx.exe'
      - '\pip.exe'
      - '\uv.exe'
      - '\uvx.exe'
  selection_cli:
    CommandLine|contains:
      - 'install'
      - 'exec'
      - 'run'
  selection_mcp:
    CommandLine|contains:
      - 'mcp'
  condition: selection_img and selection_cli and selection_mcp
falsepositives:
  - Developer workstations legitimately installing MCP tooling
level: medium

// Hunt: AI agent / MCP server processes spawning unexpected children or network activity
// Scopes to known AI tooling parents to keep noise low. Review parent baseline before alerting.
let AiToolParents = dynamic(["claude.exe", "cursor.exe", "code.exe", "node.exe", "uvx.exe", "uv.exe", "python.exe", "python3.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "certutil.exe", "bitsadmin.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (AiToolParents)
| where InitiatingProcessCommandLine has_any ("mcp", "modelcontextprotocol")
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
    ParentProcess = InitiatingProcessFileName,
    ParentCmd = InitiatingProcessCommandLine,
    ChildProcess = FileName,
    ChildCmd = ProcessCommandLine,
    SHA256
| order by TimeGenerated desc;

// Companion hunt: outbound connections from MCP server processes to rare destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessCommandLine has_any ("mcp-server", "@modelcontextprotocol", "mcp_server")
| where RemoteUrl !endswith ".anthropic.com"
  and RemoteUrl !endswith ".openai.com"
  and RemoteUrl !endswith ".github.com"
  and RemoteUrl !endswith ".npmjs.org"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| where ConnectionCount < 50   // rare/ low-volume egress is the interesting signal
| order by FirstSeen asc;

-- Hunt artifact: Inventory MCP/AI agent configuration files and recently installed
-- MCP server packages across endpoints. Deploy as a hunt; review for unauthorized
-- servers, suspicious package names, or configs modified outside change windows.
LET configs = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
  'C:/Users/*/.cursor/mcp.json',
  'C:/Users/*/.vscode/mcp.json',
  'C:/Users/*/AppData/Roaming/Code/User/mcp.json',
  'C:/Users/*/**/.mcp.json'
])

LET mcp_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)mcp[-_]?server|modelcontextprotocol'

SELECT 'config_file' AS ArtifactType, FullPath AS Path, Mtime AS Modified, NULL AS Detail
FROM configs
UNION ALL
SELECT 'running_mcp_process' AS ArtifactType, Exe AS Path, CreateTime AS Modified, CommandLine AS Detail
FROM mcp_procs

# AI Agent / MCP Server Inventory and Config Integrity Baseline
# Run via your RMM or as a scheduled task. Outputs JSON for SIEM ingestion.

$Report = @{
    Hostname   = $env:COMPUTERNAME
    Timestamp  = (Get-Date).ToUniversalTime().ToString('o')
    McpConfigs = @()
    McpServers = @()
}

# 1. Locate MCP / agent configuration files across user profiles
$configPaths = @(
    'C:/Users/*/.mcp.json'
    'C:/*/.cursor/.vscode/mcp.json',
    'C:/*/continue/.continue/mcpServers'
)

foreach ($pattern in $configPaths) {
    Get-ChildItem -Path $pattern -ErrorAction SilentlyContinue | ForEach-Object {
        $cfg = Get-Content $_.FullName -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
        $entry = @{
            Path          = $_.FullName
            LastWriteTime = $_.LastWriteTime.ToString('o')
            SHA256        = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
            Servers       = @()
        }
        # Enumerate declared MCP servers and their launch commands
        $serverBlock = if ($cfg.mcpServers) { $cfg.mcpServers } elseif ($cfg.servers) { $cfg.servers } else { $null }
        if ($serverBlock) {
            $serverBlock.PSObject.Properties | ForEach-Object {
                $entry.Servers += @{
                    Name    = $_.Name
                    Command = $_.Value.command
                    Args    = ($_.Value.args -join ' ')
                }
            }
        }
        $Report.McpConfigs += $entry
    }
}

# 2. Flag high-risk capabilities: shell access, network fetches, unscoped filesystem roots
$riskyPatterns = 'cmd|powershell|pwsh|bash|curl|wget|/c\s|C:\\$|\\\\'
foreach ($cfg in $Report.McpConfigs) {
    foreach ($srv in $cfg.Servers) {
        $joined = "$($srv.Command) $($srv.Args)"
        if ($joined -match $riskyPatterns) {
            $srv.RiskFlag = 'HIGH: server launches shell/network tooling or broad filesystem scope'
        }
        if ($srv.Name -match '^(?!(filesystem|fetch|git|sqlite|memory|time|everything)$)') {
            $srv.ReviewNote = 'Non-standard server name - verify provenance against approved inventory'
        }
    }
}

# 3. Enumerate currently running MCP server processes
Get-CimInstance Win32_Process |
    Where-Object { $_.CommandLine -match 'mcp[-_]?server|modelcontextprotocol' } |
    ForEach-Object {
        $Report.McpServers += @{
            PID         = $_.ProcessId
            CommandLine = $_.CommandLine
            Executable  = $_.ExecutablePath
        }
    }

# 4. Emit for SIEM collection
$outPath = "C:\ProgramData\SecurityOps\mcp_inventory_$($env:COMPUTERNAME).json"
New-Item -ItemType Directory -Path (Split-Path $outPath) -Force | Out-Null
$Report | ConvertTo-Json -Depth 6 | Out-File $outPath -Encoding UTF8
Write-Output "[+] MCP inventory written to $outPath"