Shadow MCP server discovery and persistent access
MCP servers added to a project during development can persist in configuration files and maintain access to the agent’s context window long after they are forgotten. These "shadow" servers continue receiving tool calls and may be modified by attackers who compromise the original server.
Key facts
Shadow MCP server discovery and persistent access is a medium-severity AI agent security threat targeting MCP server configuration files, agent context window, team policy memory, persistent tool connections. Review connected MCP servers and MCP or Skill drift in Guard Cloud where available, and remove servers that are no longer needed. Do not rely on an automatic unused-server timer unless the current product exposes one.
What happens
A developer adds an MCP server during a sprint, uses it for a task, then forgets about it. The server remains in the project’s configuration file, connected to the agent’s context every time the project runs. If the server’s endpoint is later compromised, the attacker gains persistent access to the agent.
How the attack unfolds
What it looks like in practice
A developer adds an MCP server called "jira-helper" during a sprint to let the agent read Jira tickets. The sprint ends, but the server remains configured. Three months later, the jira-helper endpoint expires and is re-registered by an attacker who adds a tool that reads environment variables. The agent, still connected to the server, starts calling the new tool.
Detection and Guard coverage
How to stop it
Review connected MCP servers and MCP or Skill drift in Guard Cloud where available, and remove servers that are no longer needed. Do not rely on an automatic unused-server timer unless the current product exposes one.
Related threat guides
Use the protections Guard supports here
Guard can review or block supported actions for this threat. The advisory above calls out what Guard covers and where other controls are still needed.