An MCP server's tool descriptions are instructions your AI will follow. Beam scans an mcp.json before you connect it — 11 heuristic patterns plus a version-pin check for tool poisoning, rug pulls and credential exfiltration.
It is heuristic triage, not semantic malware analysis and not a guarantee of safety.
MCP servers are among the riskiest things a team attaches to its AI. OWASP now catalogs tool poisoning as its own class; these are the patterns Beam checks a config against.
Poisoning
Text the user never sees but the model always reads. Beam flags credential references and delivery phrasing.
Rug pull
Tools are approved once, then quietly change. Beam flags unpinned versions, the condition that makes a silent swap possible.
Exfiltration
Environment-variable reads paired with an outbound URL, encoded payloads, or a curl-pipe-to-shell chain.
Shadowing
One server rewriting how another server's tool behaves shows up as instruction-override phrasing.
Escalation
Permission changes, writes to shell profiles and launch agents, and reverse-shell constructions.
Recon
Host enumeration and cloud instance-metadata endpoints — the classic first move after a foothold.
September 2025
A lookalike npm package added a silent BCC to an attacker address. Koi Security estimated 300 organizations affected, on 1,643 total downloads.
September and November 2025
The worm's second wave hit 796 packages with roughly 132 million monthly downloads, seeking out packages named mcp-server.
2025
The "CurXecute" issue in Cursor showed one hosted prompt rewriting MCP configuration and executing commands before the user could reject it.
01
Run the scanner against an mcp.json with --mcp. The file is read as text; no server starts and no tool is called.
02
Each finding names the category and the matched text. Pattern scanners over-flag legitimate phrasing, so the matched text is the point.
03
Add --save to persist the report beside your activity log for the same project.
Hiding malicious instructions inside an MCP server's tool descriptions or metadata — text the user never sees but the model reads and follows, such as an instruction to attach an environment variable to an outbound request. OWASP catalogs it as a distinct attack class.
No, and no scanner can. Beam runs 11 heuristic patterns plus a version-pin check against text you point it at. A clean report means nothing matched those heuristics — it is not malware analysis, and not a safety guarantee.
No. Scanning is explicit: you invoke it against a specific file. Package pulls and server installation are not intercepted, which is a deliberate v1 boundary rather than an oversight.
Every finding reports the category and the exact matched text, so you can judge it rather than take a score on faith. Pattern-based scanners are widely observed to over-flag ordinary imperative phrasing in legitimate tool descriptions.
postmark-mcp needed 1,643 downloads to reach an estimated 300 organizations. Reading a config takes a minute; unwinding a credential leak does not.