Pre-run scanning
MCP security scanning
An MCP server's tool descriptions are instructions your AI will follow. Beam scans an mcp.json before you connect it — 11 heuristic patterns plus a version-pin check for tool poisoning, rug pulls and credential exfiltration.
It is heuristic triage, not semantic malware analysis and not a guarantee of safety.
The attack classes a scan looks for
MCP servers are among the riskiest things a team attaches to its AI. OWASP now catalogs tool poisoning as its own class; these are the patterns Beam checks a config against.
- Poisoning
Hidden instructions in tool descriptions
Text the user never sees but the model always reads. Beam flags credential references and delivery phrasing.
- Rug pull
A server that mutates after approval
Tools are approved once, then quietly change. Beam flags unpinned versions, the condition that makes a silent swap possible.
- Exfiltration
Credentials routed to an endpoint
Environment-variable reads paired with an outbound URL, encoded payloads, or a curl-pipe-to-shell chain.
- Shadowing
Cross-origin instruction overrides
One server rewriting how another server's tool behaves shows up as instruction-override phrasing.
- Escalation
Privilege and persistence changes
Permission changes, writes to shell profiles and launch agents, and reverse-shell constructions.
- Recon
Network sweeps and metadata access
Host enumeration and cloud instance-metadata endpoints — the classic first move after a foothold.
How the scanner behaves
- Report retention
- 500 reports; original content is not retained
- Interception
- None — package pulls are not automatically scanned
- Verdict
- Heuristic triage — never a proof of safety
Scanning a server before you trust it
- 01
Point Beam at the config
Run the scanner against an mcp.json with --mcp. The file is read as text; no server starts and no tool is called.
- 02
Read the findings, not the verdict
Each finding names the category and the matched text. Pattern scanners over-flag legitimate phrasing, so the matched text is the point.
- 03
Save the report and move on
Add --save to persist the report beside your activity log for the same project.
The MCP supply chain has already been attacked
September 2025
postmark-mcp: the first malicious MCP server in the wild
A lookalike npm package added a silent BCC to an attacker address. Koi Security estimated 300 organizations affected, on 1,643 total downloads.
September and November 2025
Shai-Hulud npm worms targeted MCP packages by name
The worm's second wave hit 796 packages with roughly 132 million monthly downloads, seeking out packages named mcp-server.
2025
CVE-2025-54135: a prompt could rewrite an editor's MCP config
The "CurXecute" issue in Cursor showed one hosted prompt rewriting MCP configuration and executing commands before the user could reject it.
What a Beam scan is and is not
Beam does
- Check MCP configs against 11 documented instruction-abuse heuristics
- Flag unpinned server versions, the precondition for a rug pull
- Read the file as inert text, never executing what it contains
- Persist findings locally beside your AI activity log
Beam does not
- Perform semantic malware analysis or prove a server is safe
- Intercept npm installs, package pulls or server startup
- Sandbox, proxy or block an MCP server at runtime
- Replace reading the source before you hand it real credentials
Questions about MCP scanning
What is MCP tool poisoning?
Hiding malicious instructions inside an MCP server's tool descriptions or metadata — text the user never sees but the model reads and follows, such as an instruction to attach an environment variable to an outbound request. OWASP catalogs it as a distinct attack class.
Can Beam prove an MCP server is safe?
No, and no scanner can. Beam runs 11 heuristic patterns plus a version-pin check against text you point it at. A clean report means nothing matched those heuristics — it is not malware analysis, and not a safety guarantee.
Does Beam scan MCP servers automatically when I install one?
No. Scanning is explicit: you invoke it against a specific file. Package pulls and server installation are not intercepted, which is a deliberate v1 boundary rather than an oversight.
How does Beam handle false positives?
Every finding reports the category and the exact matched text, so you can judge it rather than take a score on faith. Pattern-based scanners are widely observed to over-flag ordinary imperative phrasing in legitimate tool descriptions.
Related
Scan before you connect
postmark-mcp needed 1,643 downloads to reach an estimated 300 organizations. Reading a config takes a minute; unwinding a credential leak does not.