+Intertrace Insights
MCP and the tool supply chain
What you install, what a server tells your agent, and whose consent a proxy spends.
- Pieces
- 57
- Threat research
- 16
- Updated
- Oct 20, 2026
5 pieces · newest first
Threat research10 min read
The confused deputy in MCP OAuth proxies: consent that belongs to someone else
An MCP server that fronts a third-party API with one static OAuth client can hand a user's access to a client they never approved. The eight questions a reviewer should put to any MCP OAuth proxy, answered from the specification and two fixed FastMCP advisories.
Intertrace Threat Research
Threat research10 min read
Before the first tool call: SSRF in MCP discovery and local launch as code execution
Before any tool is called, an MCP client fetches URLs the server chose and may start local processes. A field guide to the six decisions that keep the connection handshake from becoming SSRF or code execution, with the tests that prove each one.
Intertrace Threat Research
Threat research10 min read
Rug pulls and tool poisoning: an MCP approval has to cover the bytes, not the name
MCP tool descriptions are instructions the model follows, and a server can change them after you approve it. A step-by-step teardown of tool poisoning and the rug pull, and the two controls that break it: pin the exact bytes, and inspect what reviewers cannot see.
Intertrace Threat Research
News10 min read
The MCP supply chain is your package supply chain, with your agent's keys attached
Most MCP servers arrive as a README line that downloads and runs the newest package on every launch. Eight checks for the code your agents run, each tied to a public 2025 failure, with the reason it matters and the test that proves it.
Intertrace Threat Research
Threat research9 min read
Malicious model files: the questions to answer before anyone calls torch.load
Model checkpoints saved with Python pickle can run code the moment they load. The questions security and ML teams ask about malicious models, answered from the published samples, hub scanner gaps, the PyTorch 2.6 change, and an intake pipeline that does not trust the file.
Intertrace Threat Research
+Stay current
New research, the week it publishes.
Subscribe with RSS, or email support@intertrace.ai with a topic you want covered. To see the controls in action, try the Simulation Lab or read the documentation.