Tenable Exchange Inspector: Vetting Open-Source AI Agents, Skills, and MCP Servers Before They Hit Your SOC

---
title: MCP Server or AI Agent Spawning Shell or Script Interpreter
id: 3f8a2c14-7b9e-4d51-a6c3-9e1f5a2b8d04
status: experimental
description: Detects MCP servers and AI agent host processes spawning shells or script interpreters. Agent tool wrappers that shell out are a high-value target for command injection and indirect prompt injection, and unexpected shell children of an agent process warrant review.
references:
  - https://www.tenable.com/blog/tenable-openai-security-vetting-open-source-ai-agents-exchange-inspector
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\uv.exe'
      - '\uvx.exe'
      - '\npx.exe'
      - '\claude.exe'
      - '\cursor.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate MCP servers that wrap CLI tools (e.g., git, cloud CLIs) — baseline known-good servers and alert on deviation
level: high
---
title: AI Agent Process Accessing Credential Stores
id: 8c1d4e72-3a6f-4b28-9d17-5e3a7c901f2b
status: experimental
description: Detects common AI agent runtimes (node, python, uv) reading browser credential stores, SSH keys, or cloud CLI credential files. A core behavior the Exchange Inspector human-verification gate is designed to catch in trojanized agents.
references:
  - https://www.tenable.com/blog/tenable-openai-security-vetting-open-source-ai-agents-exchange-inspector
  - https://attack.mitre.org/techniques/T1555/
  - https://attack.mitre.org/techniques/T1552.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\uv.exe'
      - '\uvx.exe'
      - '\npx.exe'
  selection_target:
    CommandLine|contains:
      - '\.aws\credentials'
      - '\.ssh\id_'
      - '\Login Data'
      - '\Cookies'
      - 'Local State'
      - '\.azure\'
      - '\.config\gcloud\'
      - 'vault'
  condition: selection_parent and selection_target
falsepositives:
  - Cloud-management MCP servers legitimately reading their own CLI credentials — scope to expected file paths per approved server
level: critical
---
title: MCP Configuration File Modified
id: 61b9e3a8-2d47-4f95-b8c2-7a1e9d305c86
status: experimental
description: Detects creation or modification of MCP server configuration files for common AI clients. Unauthorized additions to these configs are a persistence and supply-chain vector — a new MCP server entry equals new code execution with user privileges and token access.
references:
  - https://www.tenable.com/blog/tenable-openai-security-vetting-open-source-ai-agents-exchange-inspector
  - https://attack.mitre.org/techniques/T1546/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1546
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'claude_desktop_config.json'
      - '\.cursor\mcp.json'
      - '\.vscode\mcp.json'
      - 'cline_mcp_settings.json'
      - '\.mcp.json'
  condition: selection
falsepositives:
  - Developers intentionally adding MCP servers — pair with change management and an allowlist of approved servers
level: medium

// Hunt: AI agent / MCP server processes with unexpected network egress
let AgentRuntimes = dynamic(["node.exe", "python.exe", "python3.exe", "uv.exe", "uvx.exe", "npx.exe", "deno.exe", "bun.exe"]);
let ApprovedMCP = dynamic(["github.com", "api.github.com", "api.openai.com", "api.anthropic.com"]); // customize per allowlist
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (AgentRuntimes)
| where isnotempty(RemoteUrl) or isnotempty(RemoteIP)
| where not(RemoteUrl has_any (ApprovedMCP))
| summarize Connections = count(),
            DistinctDestinations = dcount(RemoteIP),
            Destinations = make_set(strcat(RemoteUrl, " (", RemoteIP, ")"), 20),
            CommandLines = make_set(InitiatingProcessCommandLine, 5),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by InitiatingProcessFileName, DeviceName, InitiatingProcessAccountName
| where DistinctDestinations > 3 or Connections > 50   // tune: beaconing = low-and-slow; exfil = burst
| order by FirstSeen asc;
// Companion hunt: MCP config changes followed by first-seen process execution
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName has_any ("claude_desktop_config.json", "mcp.json", "cline_mcp_settings.json")
| where ActionType in ("FileCreated", "FileModified")
| project ConfigChange = TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where ProcessCommandLine has_any ("mcp", "uvx", "npx")
    | summarize FirstExec = min(TimeGenerated), Commands = make_set(ProcessCommandLine, 10) by DeviceName, FileName
  ) on DeviceName
| project ConfigChange, DeviceName, FolderPath, FileName1, FirstExec, Commands;

-- Inventory MCP server configurations and active agent tool processes
LET configs = SELECT FullPath, Mtime, Size,
    read_file(filename=FullPath, length=65536) AS ConfigContent
FROM glob(globs=[
  'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
  'C:/Users/*/.cursor/mcp.json',
  'C:/Users/*/.vscode/mcp.json',
  'C:/Users/*/.mcp.json',
  'C:/Users/*/AppData/Roaming/Code/User/globalStorage/*/settings/cline_mcp_settings.json'
])

LET agent_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(mcp|modelcontextprotocol|uvx |npx .*-mcp|agent)'
  AND Name =~ '(?i)(node|python|uv|npx|deno|bun)'

LET egress = SELECT Pid, Name, ProcessExe, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)(node|python|uv|npx|deno|bun)'
  AND Status = 'ESTABLISHED'
  AND RemoteAddress !~ '^(127\\.|10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)'

SELECT * FROM chain(a=configs, b=agent_procs, c=egress)

#Requires -RunAsAdministrator
# AI Agent & MCP Server Audit — approximates Exchange Inspector gate 1 (automated screening)
$report = @()

# --- 1. Inventory MCP configuration files ---
$mcpConfigPaths = @(
    "$env:APPDATA\Claude\claude_desktop_config.json",
    "$env:USERPROFILE\.cursor\mcp.json",
    "$env:USERPROFILE\.vscode\mcp.json",
    "$env:USERPROFILE\.mcp.json"
)
$approvedServers = @('github','filesystem','fetch')  # REPLACE with your vetted allowlist

foreach ($path in $mcpConfigPaths) {
    if (Test-Path $path) {
        $cfg = Get-Content $path -Raw | ConvertFrom-Json
        $servers = $cfg.mcpServers.PSObject.Properties.Name
        foreach ($s in $servers) {
            $status = if ($approvedServers -contains $s) { 'APPROVED' } else { 'UNVETTED - REVIEW REQUIRED' }
            $cmd = $cfg.mcpServers.$s.command + ' ' + ($cfg.mcpServers.$s.args -join ' ')
            $report += [pscustomobject]@{ Check='MCP-Server'; Item=$s; Detail=$cmd; Status=$status; Path=$path }
        }
    }
}

# --- 2. Scan agent/skill directories for exposed secrets (gate 1: secrets) ---
$secretPattern = '(?i)(api[_-]?key|secret|token|password|BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|sk-[a-zA-Z0-9]{20,}|AKIA[0-9A-Z]{16})'
$scanDirs = @("$env:USERPROFILE\.claude", "$env:USERPROFILE\.cursor", "$env:USERPROFILE\.config\claude")
foreach ($dir in $scanDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -Include *.json,*.md,*.py,*.js,*.ts,*.env,*.txt -ErrorAction SilentlyContinue |
          Where-Object { $_.Length -lt 1MB } | ForEach-Object {
            $hits = Select-String -Path $_.FullName -Pattern $secretPattern -ErrorAction SilentlyContinue
            foreach ($h in $hits) {
                $report += [pscustomobject]@{ Check='Secret'; Item=$_.Name; Detail="Line $($h.LineNumber)"; Status='POTENTIAL SECRET - ROTATE IF LIVE'; Path=$_.FullName }
            }
        }
    }
}

# --- 3. Flag agent processes with shell children (gate 3: runtime behavior) ---
Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match '^(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe$'
} | ForEach-Object {
    $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue
    if ($parent -and $parent.Name -match '^(node|python|uvx?|npx|deno|bun)\.exe$') {
        $report += [pscustomobject]@{ Check='Runtime'; Item="$($parent.Name) -> $($_.Name)"; Detail=$_.CommandLine; Status='SHELL CHILD OF AGENT - INVESTIGATE'; Path=$_.ExecutablePath }
    }
}

$report | Format-Table Check, Item, Status, Detail -AutoSize
$report | Export-Csv "$env:USERPROFILE\Desktop\ai-agent-audit-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "`nAudit complete. Review all UNVETTED and POTENTIAL SECRET findings before approving agent use."