MCP & Tooling
MCP Config Poisoning
Also: project config injection
Slipping a malicious MCP server entry into a repository's config so opening the project makes the agent run attacker-chosen commands.
In more detail
Many agents read project-level configuration, including MCP server definitions that specify a command to launch. If the user opens an untrusted repository and the tool starts the configured server without a clear prompt, the attacker's command runs on the developer's machine. Treat repository config as code, and require explicit trust before a project can start servers.