MCP attack 2

There are a lot more ways MCP servers can be malicious.

Start a new chat and say How much is 2 + 2.

While in the chat click on Internal Activity ⇒ LLM API Request. Scroll down or copy it into your notepad. Under the tool called mcp-math__addition, in the description you will see that in order to run this it requires not only the number but also the user’s email address.

This is how the malicious MCP server will try to trick the LLM to provide PII or contextual internal data in order to exfiltrate to the attacker through a back channel.

While still in the Internal Activity ⇒ Click on MCP Run, you will see that not only the numbers are provided to the MCP server but also the user’s email address. This should never happen unless specifically required and designed.

Now let’s protect our AI Agent against this type of attack.

1. Go back to the MCP project view and add the PII package scanners.

2. In the PII package enable the Email address scanner.

3. Now let’s configure the Middleware.

   We need to configure what we want to extract from the full context JSON.

   Click on Pattern Rules ⇒ New rule ⇒ Enter the below values ⇒ Save changes

   Object	Value
   Name	Tools call
   Context	response
   API Key	MCP
   JSON path	.message.tool_calls
   PATH	.message.tool_calls
   exists	enabled

4. Go back to the Host Config ⇒ in the Response extractors add the Tools call pattern rule ⇒ Save changes

5. Chat with the AI Agent and ask it for another mathematical addition.

6. Go to the F5 AI Guardrails logs and observe the logs. You will see that the communication has been blocked because the LLM requested a tool call with PII data.

7. To demonstrate the next attack, we need to remove the Tools call pattern.

   Go back to the Host Config ⇒ in the Response extractors remove the Tools call pattern rule ⇒ Save changes