Recorded Future MCP Server: Securing Agentic AI Access to Threat Intelligence — Deployment and Detection Guide

---
title: MCP Server Process Spawning Unexpected Child Processes
id: 3f8a2c14-7b1e-4d59-a6c2-9e1f0a5b8d73
status: experimental
description: Detects MCP server runtimes (node, python, uvx, npx) spawning shells, download cradles, or reconnaissance tools. MCP servers should be leaf processes that make API calls — child process creation is a strong indicator of tool poisoning, a malicious package, or prompt-injection-driven execution.
references:
  - https://www.recordedfuture.com/blog/mcp-intelligence-layer
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\uvx.exe'
      - '\npx.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - MCP servers that legitimately wrap CLI tooling during development; baseline known servers and tune by ParentCommandLine
level: high
---
title: Suspicious Access to MCP Configuration and Credential Files
id: 8c4d1e96-2a7f-4b38-b5d1-6f3e9a0c4d82
status: experimental
description: Detects processes other than approved agent clients reading MCP configuration files (claude_desktop_config.json, mcp.json, .env) which frequently contain API tokens for services such as Recorded Future. Token theft from MCP configs is an emerging credential-access vector.
references:
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - 'claude_desktop_config.json'
      - '\.cursor\mcp.json'
      - '\mcp\settings.json'
      - '\.codeium\windsurf\mcp_config.json'
  filter_legit:
    Image|endswith:
      - '\Claude.exe'
      - '\Cursor.exe'
      - '\Code.exe'
      - '\Windsurf.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Backup software, EDR scanners, and IT management tools; filter known binaries by hash or signer
level: high
---
title: Outbound Connection to Unapproved Threat Intelligence API Endpoint
id: b2e7a3f5-9c1d-4e68-a7b4-2d8f1c6e5a09
status: experimental
description: Detects MCP-related runtimes establishing network connections to domains outside the approved intelligence provider list. Legitimate Recorded Future MCP traffic should terminate at Recorded Future infrastructure; connections elsewhere may indicate a rogue MCP server or data exfiltration through the agent channel.
references:
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\uvx.exe'
  filter_approved:
    DestinationHostname|endswith:
      - '.recordedfuture.com'
      - '.anthropic.com'
      - '.npmjs.org'
      - '.pypi.org'
  filter_local:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_process and not filter_approved and not filter_local
falsepositives:
  - Additional legitimate MCP servers connecting to their own vendor APIs; maintain an allowlist of approved MCP provider domains and update as deployments grow
level: medium

// Hunt: MCP runtime processes spawning shells or download tools
// Run over 14 days to establish baseline, then alert on new Parent/Child pairs
let Lookback = 14d;
let McpRuntimes = dynamic(["node.exe", "python.exe", "python3.exe", "uvx.exe", "npx.exe", "uv.exe"]);
let SuspiciousChildren = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wget.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe", "rundll32.exe", "bash.exe", "sh.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ (McpRuntimes)
| where FileName in~ (SuspiciousChildren)
| extend ParentCmd = InitiatingProcessCommandLine, ChildCmd = ProcessCommandLine
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ExecutionCount = count(), DistinctHosts = dcount(DeviceName)
    by DeviceName, InitiatingProcessFileName, ParentCmd, FileName, ChildCmd, AccountName
| where ExecutionCount < 20  // suppress high-volume known-good automation
| sort by FirstSeen desc;

// Hunt: Reads of MCP config / credential files by unexpected processes
let Lookback = 7d;
let ApprovedReaders = dynamic(["claude.exe", "cursor.exe", "code.exe", "windsurf.exe", "msmpeng.exe"]);
let McpConfigPaths = dynamic(["claude_desktop_config.json", "mcp.json", "mcp_config.json", ".env"]);
DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FileName has_any (McpConfigPaths) or FolderPath has_any ("\\.cursor\\", "\\Claude\\")
| where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
   or (ActionType == "FileAccessed" and not (InitiatingProcessFileName in~ (ApprovedReaders)))
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated desc;

-- Hunt: enumerate MCP server processes and their network connections
-- Deploy as a hunt across the fleet to map where agentic tooling actually runs
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)node|python|uvx|npx'
  AND CommandLine =~ '(?i)mcp|model.context.protocol|recordedfuture'

-- Hunt: locate MCP configuration files that may contain API tokens
-- Review results for unauthorized servers or plaintext credentials
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
  'C:/Users/*/.cursor/mcp.json',
  'C:/Users/*/.codeium/windsurf/mcp_config.json',
  'C:/Users/*/.config/*/mcp*.json'
])

-- Hunt: network connections from MCP runtimes to non-approved destinations
-- Tune the approved regex to your sanctioned intelligence providers
SELECT Pid, Name, CommandLine, Family, Type, Status,
       Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ '(?i)node|python|uvx'
  AND Status =~ 'ESTAB'
  AND NOT Raddr =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

# Audit-MCPDeployment.ps1
# Run as Administrator on hosts where agent clients / MCP servers are deployed.
# Inventories MCP configs, flags plaintext tokens, and checks file ACLs.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- Locate MCP configuration files ---
$configPaths = @(
    "$env:APPDATA\Claude\claude_desktop_config.json",
    "$env:USERPROFILE\.cursor\mcp.json",
    "$env:USERPROFILE\.codeium\windsurf\mcp_config.json"
)

foreach ($path in $configPaths) {
    if (Test-Path $path) {
        $content = Get-Content $path -Raw

        # Flag plaintext API tokens in config
        $hasPlaintextToken = $content -match '(?i)(api[_-]?key|token|secret)"\s*:\s*"[A-Za-z0-9_\-]{20,}'

        # Check ACL for overly broad read access
        $acl = Get-Acl $path
        $broadAccess = $acl.Access | Where-Object {
            $_.IdentityReference -match 'Everyone|Users|Authenticated Users' -and
            $_.FileSystemRights -match 'Read|FullControl|Modify'
        }

        $report += [PSCustomObject]@{
            ConfigFile        = $path
            PlaintextToken    = $hasPlaintextToken
            OverlyPermissive  = [bool]$broadAccess
            LastModified      = (Get-Item $path).LastWriteTime
        }

        # Tighten ACLs: restrict to current user + SYSTEM + Administrators
        if ($broadAccess) {
            Write-Warning "Tightening ACL on $path"
            $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
            $newAcl = New-Object System.Security.AccessControl.FileSecurity
            $newAcl.SetAccessRuleProtection($true, $false)  # disable inheritance
            foreach ($identity in @($user, 'NT AUTHORITY\SYSTEM', 'BUILTIN\Administrators')) {
                $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
                    $identity, 'FullControl', 'Allow')
                $newAcl.AddAccessRule($rule)
            }
            Set-Acl -Path $path -AclObject $newAcl
        }
    }
}

# --- Inventory running MCP-related processes ---
$mcpProcs = Get-Process | Where-Object {
    $_.Name -match '^(node|python|python3|uvx|npx|uv)$'
} | ForEach-Object {
    $cmd = (Get-CimInstance Win32_Process -Filter "ProcessId=$($_.Id)").CommandLine
    if ($cmd -match '(?i)mcp|recordedfuture') {
        [PSCustomObject]@{
            PID         = $_.Id
            Process     = $_.Name
            CommandLine = $cmd
            StartTime   = $_.StartTime
        }
    }
}

Write-Output "=== MCP Config Audit ==="
$report | Format-Table -AutoSize
Write-Output "=== Running MCP Server Processes ==="
$mcpProcs | Format-List

if ($report.PlaintextToken -contains $true) {
    Write-Warning "Plaintext API tokens detected in MCP configs. Migrate to environment variables or a secrets manager and rotate exposed tokens immediately."
}

#!/usr/bin/env bash
# audit-mcp-linux.sh — inventory MCP configs and flag plaintext tokens on Linux/macOS hosts
set -euo pipefail

CONFIG_GLOBS=(
  "$HOME/.config/Claude/claude_desktop_config.json"
  "$HOME/.cursor/mcp.json"
  "$HOME/.codeium/windsurf/mcp_config.json"
)

echo "=== MCP Config Audit ==="
for cfg in "${CONFIG_GLOBS[@]}"; do
  if [[ -f "$cfg" ]]; then
    perms=$(stat -c '%a' "$cfg" 2>/dev/null || stat -f '%Lp' "$cfg")
    echo "[FOUND] $cfg (perms: $perms)"
    if grep -Eiq '(api[_-]?key|token|secret)"[[:space:]]*:[[:space:]]*"[A-Za-z0-9_-]{20,}' "$cfg"; then
      echo "  [ALERT] Plaintext token pattern detected — rotate and move to secrets manager"
    fi
    if [[ "$perms" != "600" ]]; then
      echo "  [FIX] Tightening permissions to 600"
      chmod 600 "$cfg"
    fi
  fi
done

echo "=== Running MCP-Related Processes ==="
ps -eo pid,ppid,user,comm,args | grep -Ei 'node|python|uvx|npx' | grep -Ei 'mcp|recordedfuture' | grep -v grep || echo "None found"

echo "=== Outbound Connections from MCP Runtimes ==="
ss -tnp 2>/dev/null | grep -Ei 'node|python|uvx' | grep -vE '127\.0\.0\.1|::1' || echo "None found (or insufficient privileges — re-run with sudo)"