MCP Python SDK OAuth Credential Leak: Detection and Remediation Guide for Token Endpoint Exfiltration

---
title: Python MCP Client OAuth Token Request To Non-Allowlisted Host
id: 2f6b1a90-7c41-4d1c-9e5a-0b7c4a9d2e11
status: experimental
description: Detects Python processes that appear to run MCP clients while making network connections to token endpoints outside approved identity provider domains.
references:
  - https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.credential_access
  - attack.t1557
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
  selection_cli:
    CommandLine|contains:
      - 'mcp'
      - 'modelcontextprotocol'
  selection_host:
    DestinationHostname|contains:
      - 'token'
  filter_idps:
    DestinationHostname|endswith:
      - '.okta.com'
      - '.auth0.com'
      - '.microsoftonline.com'
      - 'login.microsoftonline.com'
      - '.googleapis.com'
      - '.amazonaws.com'
  condition: selection_image and selection_cli and selection_host and not filter_idps
falsepositives:
  - Approved custom identity providers not yet added to the allowlist
level: high
---
title: Python MCP Client OAuth Token Request To Non-Allowlisted Host Linux
id: 9a4d0a31-2b77-4f60-b12c-6d0f2a7c91aa
status: experimental
description: Detects Linux Python processes with MCP indicators establishing outbound connections to likely OAuth token endpoints outside approved identity providers.
references:
  - https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.credential_access
  - attack.t1557
  - attack.exfiltration
logsource:
  category: network_connection
  product: linux
detection:
  selection_image:
    Image|endswith:
      - '/python'
      - '/python3'
      - '/python3.11'
      - '/python3.12'
  selection_cli:
    CommandLine|contains:
      - 'mcp'
      - 'modelcontextprotocol'
  filter_idps:
    DestinationHostname|endswith:
      - '.okta.com'
      - '.auth0.com'
      - '.microsoftonline.com'
      - 'login.microsoftonline.com'
      - '.googleapis.com'
      - '.amazonaws.com'
  condition: selection_image and selection_cli and not filter_idps
falsepositives:
  - Internal identity providers and development IdPs
level: medium
---
title: Proxy OAuth Token Exchange From Python HTTP Clients To Unusual Host
id: 70e2f4a8-51c9-44c0-9f8d-3d5b8ac61e44
status: experimental
description: Detects proxy observations of Python HTTP clients posting to OAuth token endpoints on hosts that are not approved identity providers.
references:
  - https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.credential_access
  - attack.exfiltration
  - attack.t1041
logsource:
  category: proxy
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/token'
      - '/oauth/token'
      - '/oauth2/token'
  selection_ua:
    cs-user-agent|contains:
      - 'python-requests'
      - 'httpx'
      - 'aiohttp'
      - 'urllib3'
  filter_idps:
    cs-host|endswith:
      - '.okta.com'
      - '.auth0.com'
      - '.microsoftonline.com'
      - 'login.microsoftonline.com'
      - '.googleapis.com'
      - '.amazonaws.com'
  condition: selection_path and selection_ua and not filter_idps
falsepositives:
  - Legitimate automation using approved non-listed IdPs
level: high

// Hunt MCP-capable Python clients talking to token endpoints outside approved IdPs.
// Tune the allowlist to your exact IdP domains before production use.
let ApprovedIdPs = dynamic(['okta.com','auth0.com','microsoftonline.com','googleapis.com','amazonaws.com','your-idp.example.com']);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ('python.exe','pythonw.exe','python','python3')
| where InitiatingProcessCommandLine has_any ('mcp','modelcontextprotocol')
| where RemoteUrl has_any ('/token','/oauth/token','/oauth2/token') or RemoteUrl has 'oauth'
| where not(RemoteUrl has_any (ApprovedIdPs))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType
| order by TimeGenerated desc;

-- Identify Python/MCP processes and their established outbound connections during an OAuth exposure window.
LET proc = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'mcp|modelcontextprotocol|oauth|token_endpoint'
   OR Exe =~ 'python'

LET conn = SELECT Pid, Name, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND Name =~ 'python'

SELECT proc.Pid AS Pid,
       proc.Name AS ProcessName,
       proc.Username AS Username,
       proc.CommandLine AS CommandLine,
       proc.CreateTime AS ProcessStart,
       conn.RemoteAddr AS RemoteAddr,
       conn.RemotePort AS RemotePort,
       conn.Status AS ConnStatus
FROM proc
JOIN conn ON proc.Pid = conn.Pid

#!/usr/bin/env bash
# Inventory and remediate MCP Python SDK exposure on Linux/macOS Python environments.
set -euo pipefail

FIXED='1.30.0'
FOUND=0

# Candidate virtualenvs and project environments. Add CI workspaces and container build contexts.
for d in "$HOME/.venv" "$HOME/venv" "$PWD/.venv" /opt/*/venv /srv/*/venv /workspace/*/.venv; do
  [ -x "$d/bin/python" ] || continue
  echo "[+] Checking $d"
  if "$d/bin/python" -m pip show mcp >/dev/null 2>&1; then
    FOUND=1
    VER=$("$d/bin/python" -m pip show mcp | awk -F': ' '/^Version:/{print $2}')
    echo "    installed mcp version: $VER"
    "$d/bin/python" - <<PY
from packaging.version import parse
installed = parse('$VER')
fixed = parse('$FIXED')
print('    vulnerable' if installed < fixed else '    fixed-or-newer')
PY
    "$d/bin/python" -m pip install --upgrade 'mcp>=1.30.0'
    "$d/bin/python" -m pip show mcp | egrep 'Name|Version|Location'
  fi
done

# Look for OAuth token endpoints and MCP wiring in likely config locations.
for base in "$PWD" "$HOME/.config" "$HOME/Library/Application Support" /opt /srv; do
  [ -d "$base" ] || continue
  grep -RIl --exclude-dir=.git --exclude='*.pyc' 'modelcontextprotocol\|token_endpoint\|mcpServers\|client_secret\|code_verifier' "$base" 2>/dev/null | head -200
 done

if [ "$FOUND" -eq 0 ]; then
  echo '[*] No mcp package found in candidate environments; expand search for containers and CI images.'
fi

echo '[*] Next: rotate OAuth client secrets for any app that connected to untrusted MCP servers while vulnerable.'