Content
# SAFE-MCP: Security Analysis Framework for Evaluation of Model Context Protocol
| SIG-SAFE-MCP | Details |
| ---------------- | ------------------------------------------------------------------------------------------ |
| **Mailing List** | [openssf-sig-safe-mcp@lists.openssf.org](https://lists.openssf.org/g/openssf-sig-safe-mcp) |
| **SIG Leads** | Sarah Evans; Frederick Kautz |
| **Meeting Time** | 1:00 PM PT (PST/PDT) Bi-Weekly |
| **Slack** | OpenSSF #sig-safe-mcp |
## About SAFE-MCP
SAFE-MCP is a comprehensive security framework for documenting and mitigating threats in the Model Context Protocol (MCP) ecosystem. This framework adapts the proven MITRE ATT&CK methodology specifically for MCP environments, providing structured documentation of adversary tactics, techniques, and procedures (TTPs) that target MCP implementations and AI-powered applications.
### Key Features
- **MITRE ATT&CK Alignment**: We use patterns and methodologies from the MITRE ATT&CK Framework, explicitly targeting MCP-specific threats while maintaining compatibility with established security practices.
- **Compliance Mapping**: Each SAFE-MCP technique links to corresponding MITRE ATT&CK techniques where applicable, helping organizations determine compliance with existing security frameworks and controls.
- **Comprehensive Coverage**: Documenting attack techniques across 14 tactical categories, from initial access to impact, with continuous additions as new threats emerge.
- **Actionable Mitigations**: Each technique includes detailed mitigation strategies and detection rules to help defenders protect their MCP deployments.
### How to Use This Framework
1. **Security Teams**: Use the TTP reference table below to understand potential threats to your MCP implementation
2. **Developers**: Review techniques relevant to your MCP tools and implement recommended mitigations
3. **Compliance Officers**: Map SAFE-MCP techniques to your existing security controls via MITRE ATT&CK linkages
4. **Red Teams**: Reference attack techniques for security testing of MCP deployments
## TTP Reference Table
This table provides a comprehensive reference of all Tactics, Techniques, and Procedures (TTPs) defined in the SAFE-MCP framework.
## SAFE-MCP Tactics
The SAFE-MCP framework defines 14 tactics that align with the MITRE ATT&CK methodology:
| Tactic ID | Tactic Name | Description |
| ---------- | -------------------- | ------------------------------------------------------------------------------------ |
| ATK-TA0043 | Reconnaissance | The adversary is trying to gather information they can use to plan future operations |
| ATK-TA0042 | Resource Development | The adversary is trying to establish resources they can use to support operations |
| ATK-TA0001 | Initial Access | The adversary is trying to get into your MCP environment |
| ATK-TA0002 | Execution | The adversary is trying to run malicious code via MCP |
| ATK-TA0003 | Persistence | The adversary is trying to maintain their foothold in MCP |
| ATK-TA0004 | Privilege Escalation | The adversary is trying to gain higher-level permissions |
| ATK-TA0005 | Defense Evasion | The adversary is trying to avoid being detected |
| ATK-TA0006 | Credential Access | The adversary is trying to steal account names and passwords |
| ATK-TA0007 | Discovery | The adversary is trying to figure out your MCP environment |
| ATK-TA0008 | Lateral Movement | The adversary is trying to move through your environment |
| ATK-TA0009 | Collection | The adversary is trying to gather data of interest |
| ATK-TA0011 | Command and Control | The adversary is trying to communicate with compromised systems |
| ATK-TA0010 | Exfiltration | The adversary is trying to steal data |
| ATK-TA0040 | Impact | The adversary is trying to manipulate, interrupt, or destroy systems and data |
## TTP Overview
| Tactic ID | Tactic Name | Technique ID | Technique Name | Description |
| -------------- | ------------------------ | ---------------------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **ATK-TA0043** | **Reconnaissance** | | | _No MCP-specific techniques currently documented_ |
| **ATK-TA0042** | **Resource Development** | [SAFE-T2107](techniques/SAFE-T2107/README.md) | AI Model Poisoning via MCP Tool Training Data Contamination | Attackers contaminate training data used to develop AI models for MCP tools, implanting backdoors that activate during specific conditions |
| **ATK-TA0001** | **Initial Access** | [SAFE-T1001](techniques/SAFE-T1001/README.md) | Tool Poisoning Attack (TPA) | Attackers embed malicious instructions within MCP tool descriptions that are invisible to users but processed by LLMs |
| ATK-TA0001 | Initial Access | [SAFE-T1002](techniques/SAFE-T1002/README.md) | Supply Chain Compromise | Distribution of backdoored MCP server packages through unofficial repositories or compromised legitimate sources |
| ATK-TA0001 | Initial Access | [SAFE-T1003](techniques/SAFE-T1003/README.md) | Malicious MCP-Server Distribution | Adversary ships a trojanized server package or Docker image that users install, gaining foothold when the host registers its tools |
| ATK-TA0001 | Initial Access | [SAFE-T1004](techniques/SAFE-T1004/README.md) | Server Impersonation / Name-Collision | Attacker registers a server with the same name/URL as a trusted one, or hijacks discovery, so the client connects to them instead |
| ATK-TA0001 | Initial Access | [SAFE-T1005](techniques/SAFE-T1005/README.md) | Exposed Endpoint Exploit | Misconfigured public MCP endpoints (no auth, debug on) let attackers connect, enumerate tools or trigger RCE |
| ATK-TA0001 | Initial Access | [SAFE-T1006](techniques/SAFE-T1006/README.md) | User-Social-Engineering Install | Phishing/social posts persuade developers to "try this cool tool"; the installer silently registers dangerous capabilities |
| ATK-TA0001 | Initial Access | [SAFE-T1007](techniques/SAFE-T1007/README.md) | OAuth Authorization Phishing | Malicious MCP servers exploit OAuth flows to steal access tokens from legitimate services by tricking users during authorization |
| ATK-TA0001 | Initial Access | [SAFE-T1008](techniques/SAFE-T1008/README.md) | Tool Shadowing Attack | Malicious MCP servers impersonate or interfere with legitimate tools to hijack execution within MCP-based workflows through cross-server tool interference |
| ATK-TA0001 | Initial Access | [SAFE-T1009](techniques/SAFE-T1009/README.md) | Authorization Server Mix-up | Client follows redirect to look-alike AS domain (e.g., accounts-google.com vs accounts.google.com), causing authorization codes or tokens to be leaked to attacker-controlled server |
| **ATK-TA0002** | **Execution** | [SAFE-T1101](techniques/SAFE-T1101/README.md) | Command Injection | Exploitation of unsanitized input in MCP server implementations leading to remote code execution |
| ATK-TA0002 | Execution | [SAFE-T1102](techniques/SAFE-T1102/README.md) | Prompt Injection (Multiple Vectors) | Malicious instructions injected through various vectors to manipulate AI behavior via MCP |
| ATK-TA0002 | Execution | [SAFE-T1103](techniques/SAFE-T1103/README.md) | Fake Tool Invocation (Function Spoofing) | Adversary forges JSON that mimics an MCP function-call message, tricking the host into running a tool that was never offered |
| ATK-TA0002 | Execution | [SAFE-T1104](techniques/SAFE-T1104/README.md) | Over-Privileged Tool Abuse | Legit tool (e.g. "Shell") runs with broader OS rights than necessary; LLM can be induced to perform arbitrary commands |
| ATK-TA0002 | Execution | [SAFE-T1105](techniques/SAFE-T1105/README.md) | Path Traversal via File Tool | File-handling tool accepts relative paths like ../../secret.key; attacker leaks host secrets |
| ATK-TA0002 | Execution | [SAFE-T1106](techniques/SAFE-T1106/README.md) | Autonomous Loop Exploit | Craft prompts that push an agent into infinite "self-invoke" loop to exhaust CPU or hit rate limits (DoS) |
| ATK-TA0002 | Execution | [SAFE-T1109](techniques/SAFE-T1109/README.md) | Debugging Tool Exploitation | Browser-based remote code execution via vulnerable MCP Inspector (CVE-2025-49596) |
| ATK-TA0002 | Execution | [SAFE-T1110](techniques/SAFE-T1110/README.md) | Multimodal Prompt Injection via Images/Audio | Embedding malicious instructions within image or audio content to manipulate multimodal AI behavior |
| ATK-TA0002 | Execution | [SAFE-T1111](techniques/SAFE-T1111/README.md) | AI Agent CLI Weaponization | Malicious exploitation of AI coding assistant CLI tools with dangerous flags for reconnaissance and data exfiltration |
| ATK-TA0002 | Execution | [SAFE-T1112](techniques/SAFE-T1112/README.md) | Sampling Request Abuse | Malicious or compromised MCP servers abuse `sampling/createMessage` to drain model quota, bias nested reasoning, or pivot into sensitive tool-enabled actions during otherwise legitimate flows |
| **ATK-TA0003** | **Persistence** | [SAFE-T1201](techniques/SAFE-T1201/README.md) | MCP Rug Pull Attack | Time-delayed malicious tool definition changes after initial approval |
| ATK-TA0003 | Persistence | [SAFE-T1202](techniques/SAFE-T1202/README.md) | OAuth Token Persistence | Theft and reuse of OAuth access/refresh tokens for persistent access to MCP-connected services, including replay of refresh tokens after legitimate client sessions end |
| ATK-TA0003 | Persistence | [SAFE-T1203](techniques/SAFE-T1203/README.md) | Backdoored Server Binary | Inserts cron job or reverse shell on install; persists even if MCP service is uninstalled |
| ATK-TA0003 | Persistence | [SAFE-T1204](techniques/SAFE-T1204/README.md) | Context Memory Implant | Malicious agent writes itself into long-term vector store; re-loaded in every future session |
| ATK-TA0003 | Persistence | [SAFE-T1205](techniques/SAFE-T1205/README.md) | Persistent Tool Redefinition | Attacker modifies server's tool metadata to keep hidden commands across restarts |
| ATK-TA0003 | Persistence | SAFE-T1206 | Credential Implant in Config | Adds attacker's API/SSH keys to server .env, giving re-entry |
| ATK-TA0003 | Persistence | SAFE-T1207 | Hijack Update Mechanism | Man-in-the-middle an auto-update channel to re-install malicious build later on |
| ATK-TA0003 | Persistence | [SAFE-T2106](techniques/SAFE-T2106/README.md) | Context Memory Poisoning via Vector Store Contamination | Attackers manipulate vector databases storing long-term memory for AI agents, creating persistent malicious content that contaminates knowledge across all future sessions |
| **ATK-TA0004** | **Privilege Escalation** | [SAFE-T1301](techniques/SAFE-T1301/README.md) | Cross-Server Tool Shadowing | Malicious MCP servers override legitimate tool calls to gain elevated privileges |
| ATK-TA0004 | Privilege Escalation | [SAFE-T1302](techniques/SAFE-T1302/README.md) | High-Privilege Tool Abuse | Invoke a VM-level or root tool from normal user context |
| ATK-TA0004 | Privilege Escalation | [SAFE-T1303](techniques/SAFE-T1303/README.md) | Sandbox Escape via Server Exec | Exploit vulnerable server to break container/seccomp isolation |
| ATK-TA0004 | Privilege Escalation | [SAFE-T1304](techniques/SAFE-T1304/README.md) | Credential Relay Chain | Use one tool to steal tokens, feed them to second tool with higher privileges |
| ATK-TA0004 | Privilege Escalation | [SAFE-T1305](techniques/SAFE-T1305/README.md) | Host OS Priv-Esc (RCE) | Achieve root via misconfigured service running as root, then alter host |
| ATK-TA0004 | Privilege Escalation | [SAFE-T1306](techniques/SAFE-T1306/README.md) | Rogue Authorization Server | Malicious MCP server redirects OAuth flows to attacker-controlled AS that ignores audience restrictions and Proof of Possession (PoP), minting overly-permissive "super-tokens" with expanded scopes |
| ATK-TA0004 | Privilege Escalation | [SAFE-T1307](techniques/SAFE-T1307/README.md) | Confused Deputy Attack | MCP server receives token for one user (Alice) and forwards it to another user's (Bob) MCP instance, allowing Bob to perform actions as Alice by exploiting the server's trusted position |
| ATK-TA0004 | Privilege Escalation | [SAFE-T1308](techniques/SAFE-T1308/README.md) | Token Scope Substitution | Attacker swaps a limited-scope token with one that has broader permissions but same audience, exploiting insufficient scope validation to gain elevated privileges
| ATK-TA0004 | Privilege Escalation | [SAFE-T1309](techniques/SAFE-T1309/README.md) | Privileged Tool Invocation via Prompt Manipulation | Adversary manipulates MCP agent prompts to bypass safety rules and invoke privileged tools | |
| **ATK-TA0005** | **Defense Evasion** | [SAFE-T1401](techniques/SAFE-T1401/README.md) | Line Jumping | Bypassing security checkpoints through context injection before tool invocation |
| ATK-TA0005 | Defense Evasion | [SAFE-T1402](techniques/SAFE-T1402/README.md) | Instruction Steganography | Zero-width chars/HTML comments hide directives in tool metadata |
| ATK-TA0005 | Defense Evasion | [SAFE-T1403](techniques/SAFE-T1403/README.md) | Consent-Fatigue Exploit | Repeated benign prompts desensitize user; crucial request hidden mid-flow |
| ATK-TA0005 | Defense Evasion | [SAFE-T1404](techniques/SAFE-T1404/README.md) | Response Tampering | Model instructed not to mention risky action, keeping UI output "harmless" |
| ATK-TA0005 | Defense Evasion | SAFE-T1405 | Tool Obfuscation/Renaming | Malicious tool named "Utils-Helper" to blend in among 30 legit tools |
| ATK-TA0005 | Defense Evasion | SAFE-T1406 | Metadata Manipulation | Strip safety flags or lower risk scores in tool manifest before host logs it |
| ATK-TA0005 | Defense Evasion | [SAFE-T1407](techniques/SAFE-T1407/README.md) | Server Proxy Masquerade | Malicious server silently proxies legit API so traffic looks normal in network logs |
| ATK-TA0005 | Defense Evasion | [SAFE-T1408](techniques/SAFE-T1408/README.md) | OAuth Protocol Downgrade | Attacker forces use of less secure OAuth 2.0 implicit flow instead of authorization code flow, bypassing PKCE protections and enabling easier token theft |
| **ATK-TA0006** | **Credential Access** | [SAFE-T1501](techniques/SAFE-T1501/README.md) | Full-Schema Poisoning (FSP) | Exploitation of entire MCP tool schema beyond descriptions for credential theft |
| ATK-TA0006 | Credential Access | [SAFE-T1502](techniques/SAFE-T1502/README.md) | File-Based Credential Harvest | Use file tools to read SSH keys, cloud creds |
| ATK-TA0006 | Credential Access | [SAFE-T1503](techniques/SAFE-T1503/README.md) | Env-Var Scraping | Ask read_file for .env; exfil API secrets |
| ATK-TA0006 | Credential Access | [SAFE-T1504](techniques/SAFE-T1504/README.md) | Token Theft via API Response | Prompt LLM to call "session.token" tool, then leak result |
| ATK-TA0006 | Credential Access | [SAFE-T1505](techniques/SAFE-T1505/README.md) | In-Memory Secret Extraction | Query vector store for "api_key" embedding strings |
| ATK-TA0006 | Credential Access | SAFE-T1506 | Infrastructure Token Theft | Steal OAuth/session tokens from logs, TLS termination proxies, or other infrastructure components where tokens may be inadvertently stored or exposed, then replay at intended service |
| ATK-TA0006 | Credential Access | [SAFE-T1507](techniques/SAFE-T1507/README.md) | Authorization Code Interception | Man-in-the-browser attack steals OAuth authorization codes during the redirect flow and attempts to exchange them at the token endpoint before the legitimate client |
| **ATK-TA0007** | **Discovery** | [SAFE-T1601](techniques/SAFE-T1601/README.md) | MCP Server Enumeration | Unauthorized discovery and mapping of available MCP servers and tools |
| ATK-TA0007 | Discovery | [SAFE-T1602](techniques/SAFE-T1602/README.md) | Tool Enumeration | Call tools/list to see available functions |
| ATK-TA0007 | Discovery | [SAFE-T1603](techniques/SAFE-T1603/README.md) | System Prompt Disclosure | Adversaries attempt to extract internal system prompts and security policies governing AI agent behavior through multi-turn conversational attacks exploiting LLM sycophancy |
| ATK-TA0007 | Discovery | SAFE-T1604 | Server Version Enumeration | GET /version or header analysis for vulnerable builds |
| ATK-TA0007 | Discovery | [SAFE-T1605](techniques/SAFE-T1605/README.md) | Capability Mapping | Ask "what can you do?"; model outlines high-value tools |
| ATK-TA0007 | Discovery | [SAFE-T1606](techniques/SAFE-T1606/README.md) | Directory Listing via File Tool | List root dir to find sensitive paths |
| **ATK-TA0008** | **Lateral Movement** | [SAFE-T1701](techniques/SAFE-T1701/README.md) | Cross-Tool Contamination | Using compromised MCP tools to access other connected services and systems |
| ATK-TA0008 | Lateral Movement | [SAFE-T1702](techniques/SAFE-T1702/README.md) | Shared-Memory Poisoning | Write false tasks to shared vector DB so peer agents execute them |
| ATK-TA0008 | Lateral Movement | [SAFE-T1703](techniques/SAFE-T1703/README.md) | Tool-Chaining Pivot | Compromise low-priv tool, then leverage it to call another privileged tool indirectly |
| ATK-TA0008 | Lateral Movement | [SAFE-T1704](techniques/SAFE-T1704/README.md) | Compromised-Server Pivot | Use hijacked server as beachhead to infect other hosts in same IDE/workspace |
| ATK-TA0008 | Lateral Movement | [SAFE-T1705](techniques/SAFE-T1705/README.md) | Cross-Agent Instruction Injection | Inject directives in multi-agent message bus to seize control of cooperating agents |
| ATK-TA0008 | Lateral Movement | [SAFE-T1706](techniques/SAFE-T1706/README.md) | OAuth Token Pivot Replay | Attacker reuses OAuth tokens across different services by exploiting either shared Authorization Server trust (e.g., GitHub token used at Slack) or Resource Servers that fail to validate audience claims, enabling unauthorized cross-service access |
| ATK-TA0008 | Lateral Movement | [SAFE-T1707](techniques/SAFE-T1707/README.md) | CSRF Token Relay | Leaked OAuth token is passed via Cross-Site Request Forgery to access different resources on the same Resource Server (e.g., pivoting between GCP projects under same Google AS) |
| **ATK-TA0009** | **Collection** | [SAFE-T1801](/techniques/SAFE-T1801/README.md) | Automated Data Harvesting | Systematic data collection through manipulated MCP tool calls |
| ATK-TA0009 | Collection | SAFE-T1802 | File Collection | Batch-read sensitive files for later exfil |
| ATK-TA0009 | Collection | [SAFE-T1803](techniques/SAFE-T1803/README.md) | Database Dump | Use SQL tool to SELECT \* from prod DB |
| ATK-TA0009 | Collection | [SAFE-T1804](techniques/SAFE-T1804/README.md) | API Data Harvest | Loop over customer REST endpoints via HTTP tool |
| ATK-TA0009 | Collection | SAFE-T1805 | Context Snapshot Capture | Query vector store embeddings wholesale |
| **ATK-TA0011** | **Command and Control** | SAFE-T1901 | Outbound Webhook C2 | LLM calls "http.post" to attacker URL with commands/results |
| ATK-TA0011 | Command and Control | SAFE-T1902 | Covert Channel in Responses | Encode data in whitespace or markdown links returned to chat |
| ATK-TA0011 | Command and Control | SAFE-T1903 | Malicious Server Control Channel | Attacker operates rogue server; every tool call doubles as heartbeat |
| ATK-TA0011 | Command and Control | [SAFE-T1904](techniques/SAFE-T1904/README.md) | Chat-Based Backchannel | LLM embeds base64 blobs in normal answers that another bot decodes |
| **ATK-TA0010** | **Exfiltration** | [SAFE-T1910](techniques/SAFE-T1910/README.md) | Covert Channel Exfiltration | Data smuggling through tool parameters, error messages, or legitimate-appearing operations |
| ATK-TA0010 | Exfiltration | [SAFE-T1911](techniques/SAFE-T1911/README.md) | Parameter Exfiltration | Sneak secrets into unused JSON arg (note) |
| ATK-TA0010 | Exfiltration | [SAFE-T1912](techniques/SAFE-T1912/README.md) | Stego Response Exfil | Hide data in code blocks shown to user then copied elsewhere |
| ATK-TA0010 | Exfiltration | SAFE-T1913 | HTTP POST Exfil | Use outbound web tool to POST to attacker server |
| ATK-TA0010 | Exfiltration | SAFE-T1914 | Tool-to-Tool Exfil | Chain two tools so second one emails data out |
| ATK-TA0010 | Exfiltration | [SAFE-T1915](techniques/SAFE-T1915/README.md) | Cross-Chain Laundering via Bridges/DEXs | Multi-chain asset transfers using bridges and DEXs to obscure provenance and evade detection |
| **ATK-TA0040** | **Impact** | [SAFE-T2101](techniques/SAFE-T2101/README.md) | Data Destruction | delete_file or drop_table commands wipe assets |
| ATK-TA0040 | Impact | [SAFE-T2102](https://github.com/SAFE-MCP/safe-mcp/blob/main/techniques/SAFE-T2102/README.md) | Service Disruption | Flood external API causing rate-limit or DoS |
| ATK-TA0040 | Impact | [SAFE-T2103](techniques/SAFE-T2103/README.md) | Code Sabotage | Agent commits malicious PR into repo |
| ATK-TA0040 | Impact | SAFE-T2104 | Fraudulent Transactions | Payment-tool instructed to move funds |
| ATK-TA0040 | Impact | [SAFE-T2105](techniques/SAFE-T2105/README.md) | Disinformation Output | Manipulate LLM to generate false or harmful content to downstream consumers |
| ATK-TA0040 | Impact | [SAFE-T3001](techniques/SAFE-T3001/README.md) | RAG Backdoor Attack | Implanting covert triggers in RAG pipeline to manipulate retrieval and generation under specific conditions |
## Summary Statistics
- **Total Tactics**: 14
- **Total Techniques**: 85
- **Average Techniques per Tactic**: 6.1
## Tactic Distribution
| Tactic | Number of Techniques |
| -------------------- | -------------------- |
| Reconnaissance | 0 |
| Resource Development | 1 |
| Initial Access | 9 |
| Execution | 10 |
| Persistence | 8 |
| Privilege Escalation | 9 |
| Defense Evasion | 8 |
| Credential Access | 7 |
| Discovery | 6 |
| Lateral Movement | 7 |
| Collection | 5 |
| Command and Control | 4 |
| Exfiltration | 6 |
| Impact | 6 |
## Usage Guidelines
- Use technique IDs (e.g., SAFE-T1001) for consistent reference across documentation
- Map these techniques to your specific MCP deployment for risk assessment
- Prioritize mitigation based on your threat model and the techniques most relevant to your environment
- Regular review as new techniques emerge in the rapidly evolving MCP threat landscape
