Run any Skill in Manus with one click

detect-mcp-tool-drift

Stars3

Forks0

UpdatedJuly 10, 2026 at 03:53

Detect MCP tool schema drift mid-session — the MCP tool-poisoning / rug-pull attack pattern. Reads OCSF 1.8 Application Activity (class 6002) or the native application-activity projection produced by ingest-mcp-proxy-ocsf, groups them by session, and flags any tool whose fingerprint (sha256 over name + description + inputSchema + annotations) changes between tools/list responses in the same session. Emits OCSF 1.8 Detection Finding (class 2004) with MITRE ATT&CK T1195.001 (Compromise Software Supply Chain) inside finding_info.attacks. Use when the user mentions MCP security, tool drift, tool poisoning, prompt injection via tool schema, or supply chain compromise of an MCP server. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use for cross-session drift (same tool, different sessions) — that is a legitimate MCP server update, not an attack; a separate detector will cover it. Do NOT use for divergence against an out-of-band server-registered baseline — that is detect-m

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

msaad00

msaad00/cloud-ai-security-skills

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

6 files

SKILL.md

readonly

More from this repository

same repository

cspm-azure-cis-benchmark

msaad00/cloud-ai-security-skills

Assess Azure subscriptions against a curated subset of CIS Azure Foundations Benchmark v2.1. Automates 32 high-impact read-only checks across Identity, Defender for Cloud, Storage, Database, Logging, Networking, Compute, Key Vault, and App Service (~53% of the v2.1 benchmark). Use when the user mentions Azure CIS benchmark, Azure storage security, or unrestricted SSH/RDP detection in NSGs. Do NOT use for AWS or GCP; do NOT use to remediate findings (assessment-only, Reader role only); do NOT claim full CIS Azure coverage — only 32 of 60 controls are implemented, see the Roadmap section in this file for the gap.

2026-07-113

ingest-entra-directory-audit-ocsf

msaad00/cloud-ai-security-skills

Convert verified Microsoft Entra directoryAudit events into OCSF 1.8 API Activity (6003). The first slice maps Microsoft Graph directory audit events for service-principal credential changes, app-role grants, and federated identity credential creation into deterministic OCSF records while preserving Entra natural IDs such as id, correlationId, and activityDateTime for SIEM dedupe and downstream correlation. Use when the user mentions Entra audit log ingestion, Microsoft Graph directoryAudit normalization, or feeding Entra identity telemetry into an OCSF pipeline. Do NOT use for Okta System Log, Azure Activity Logs, or as a detector or policy engine — this skill only normalizes verified Microsoft Graph directoryAudit payloads.

2026-07-113

ingest-k8s-audit-ocsf

msaad00/cloud-ai-security-skills

Convert raw Kubernetes audit logs (`audit.k8s.io/v1`) into normalized API activity records, with OCSF as the default wire format and native output as an option. Maps user, source IP, verb, objectRef, and response status with enough fidelity for K8s privilege-escalation and secret-access detectors. Use when the user mentions Kubernetes audit logs, kube-apiserver audit sinks, K8s detection engineering, or feeding K8s audit into a SIEM. Do NOT use for container runtime logs, kubelet logs, or CloudTrail / GCP audit / Azure Activity. Do NOT use as a detection skill; this only normalizes events.

2026-07-113

ingest-okta-system-log-ocsf

msaad00/cloud-ai-security-skills

Convert verified Okta System Log events into OCSF 1.8 or native Identity & Access Management records. The first slice maps session and SSO events to Authentication (3002), user lifecycle and account-control changes to Account Change (3001), app/group membership updates to User Access Management (3005), and a narrow verified set of Okta Verify MFA challenge and denial events to Authentication (3002). It preserves Okta natural IDs such as uuid, published, transaction.id, and authenticationContext.externalSessionId for SIEM-friendly dedupe and correlation. Use when the user mentions Okta System Log ingestion, Okta audit log normalization, cross-vendor identity telemetry, or feeding Okta identity events into an OCSF pipeline or native canonical-first flow. Do NOT use for raw Azure Entra, Google Workspace, or AWS IAM logs. Do NOT use as a detector or policy engine — this skill only normalizes verified Okta event payloads into OCSF or native output.

2026-07-113

detect-aws-access-key-creation

msaad00/cloud-ai-security-skills

Detect successful AWS IAM `CreateAccessKey` API calls against IAM users from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) when a principal creates an access key for an IAM user. Use when the user mentions "AWS access key created", "IAM user key issuance", "additional cloud credentials in AWS", or "T1098.001 via CloudTrail". Do NOT use as a posture-at-rest access-key inventory check, to infer console-password or login-profile creation, or to claim every AWS identity-pivot path. This first slice only covers successful `CreateAccessKey` operations.

2026-07-103

detect-prompt-injection-mcp-proxy

msaad00/cloud-ai-security-skills

Detect suspicious prompt-injection and instruction-smuggling language in MCP tool descriptions from ingest-mcp-proxy-ocsf. Reads OCSF 1.8 Application Activity (class 6002) or the native application-activity projection, keeps a narrow high-signal scope, and flags `tools/list` responses whose tool descriptions explicitly tell an agent to ignore prior instructions, reveal a system or developer prompt, bypass guardrails, or exfiltrate secrets or conversation history. Emits OCSF 1.8 Detection Finding (class 2004) with MITRE ATLAS AML.T0051 Prompt Injection. Use when the user mentions MCP prompt injection, instruction smuggling in tool metadata, malicious tool descriptions, or AI-agent tool poisoning beyond simple schema drift. Do NOT use on raw MCP proxy logs — normalize them through ingest-mcp-proxy-ocsf first. Do NOT use as a general content-moderation classifier or on tool-call results; this slice only covers suspicious tool declarations in `tools/list` responses.

2026-07-103

name	detect-mcp-tool-drift
description	Detect MCP tool schema drift mid-session — the MCP tool-poisoning / rug-pull attack pattern. Reads OCSF 1.8 Application Activity (class 6002) or the native application-activity projection produced by ingest-mcp-proxy-ocsf, groups them by session, and flags any tool whose fingerprint (sha256 over name + description + inputSchema + annotations) changes between tools/list responses in the same session. Emits OCSF 1.8 Detection Finding (class 2004) with MITRE ATT&CK T1195.001 (Compromise Software Supply Chain) inside finding_info.attacks. Use when the user mentions MCP security, tool drift, tool poisoning, prompt injection via tool schema, or supply chain compromise of an MCP server. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use for cross-session drift (same tool, different sessions) — that is a legitimate MCP server update, not an attack; a separate detector will cover it. Do NOT use for divergence against an out-of-band server-registered baseline — that is detect-mcp-shadow-tool-injection. Do NOT use as a compliance check; this is an active detection skill.
purpose	Detect MCP tool schema drift mid-session — the MCP tool-poisoning / rug-pull attack pattern.
capability	detect
persistence	none
telemetry	stderr_jsonl
privilege_escalation	none
license	Apache-2.0
approval_model	none
execution_modes	jit, ci, mcp, persistent
side_effects	none
input_formats	canonical, native, ocsf
output_formats	native, ocsf
concurrency_safety	stateless

detect-mcp-tool-drift

Attack pattern

An MCP server can change the schema of a tool between calls in the same session. A benign-looking query_db(sql) tool with readOnly: true in the first tools/list response can come back in the second tools/list response (after the agent has already trusted the first definition) with a new write argument and readOnly: false. By the time the agent sees the updated schema, it may have already been primed by the original description and will happily call query_db(sql="DELETE …", write=true).

This is the MCP tool-poisoning / rug-pull pattern. It maps to MITRE ATT&CK T1195.001 — Supply Chain Compromise: Compromise Software Supply Chain. The tool is the "software"; the MCP server is the "supply chain."

Detection logic

Walk MCP Application Activity events in timestamp order. The detector accepts:

OCSF Application Activity emitted by ingest-mcp-proxy-ocsf
the native or canonical activity projection emitted by the same skill when --output-format native is selected

For each session and tool name, track the last-seen fingerprint. If a later tools/list entry for the same (session, tool name) has a different fingerprint, emit one Detection Finding per drift event.

state[(session_uid, tool_name)] = last_fingerprint

Same fingerprint in the same session → no finding (idempotent republish of the same tool is normal).
Different fingerprint in the same session → finding.
Different fingerprint in a different session → ignored (cross-session is a separate detector).

Output contract

One Detection Finding per drift event. By default the skill emits OCSF 1.8 Detection Finding (class 2004). With --output-format native, it emits the repo-owned native finding projection.

OCSF output populates:

finding_info.attacks[]: MITRE ATT&CK v14, tactic TA0001 (Initial Access), technique T1195.001 (Compromise Software Supply Chain).
finding_info.types[]: ["mcp-tool-drift"] for downstream filtering.
finding_info.first_seen_time / finding_info.last_seen_time: timestamps of the two tools/list events that triggered the finding.
finding_info.uid: deterministic (det-mcp-drift-<session>-<tool>-<before-8>-<after-8>) so re-running on the same fixture is idempotent.
observables[]: session uid, tool name, before/after fingerprints.
evidence: event counts and pointers to the raw tools/list records.

See ../OCSF_CONTRACT.md for the full Detection Finding contract.

Usage

# Piped from the ingest skill
python ../ingest-mcp-proxy-ocsf/src/ingest.py mcp-proxy.jsonl \
  | python src/detect.py \
  > drift-findings.ocsf.jsonl

# Native input and native output
python ../ingest-mcp-proxy-ocsf/src/ingest.py mcp-proxy.jsonl --output-format native \
  | python src/detect.py --output-format native \
  > drift-findings.native.jsonl

# Standalone file
python src/detect.py ../golden/mcp_proxy_sample.ocsf.jsonl

Native output format

When --output-format native is selected, the skill emits:

schema_mode: "native"
canonical_schema_version
record_type: "detection_finding"
finding_uid and event_uid
provider
time_ms
session_uid
tool_name
before_fingerprint
after_fingerprint
mitre_attacks

Example:

{
  "schema_mode": "native",
  "canonical_schema_version": "2026-04",
  "record_type": "detection_finding",
  "finding_uid": "det-mcp-drift-sess-abc-query_db-9b5f6e3c-7d10a2bf",
  "provider": "MCP",
  "session_uid": "sess-abc",
  "tool_name": "query_db",
  "before_fingerprint": "sha256:...",
  "after_fingerprint": "sha256:..."
}

Tests

Golden-fixture parity: runs against ../golden/mcp_proxy_sample.ocsf.jsonl and asserts the output matches ../golden/tool_drift_finding.ocsf.json exactly (with volatile fields scrubbed).