compare: TrustFall-style project-defined MCP onboarding risk

TrustFall-style project-defined MCP onboarding risk

MCP02MCP04Human-in-the-Loopresources/readtools/call

What just happened in your session

vulnerablecompare-vuln-remote-trustfall-project-mcp-settings2026-11-06T13:27:04.342800+00:00

side effect landed in /app/var/process-ledger.jsonl

defendedcompare-def-remote-trustfall-project-mcp-settings2026-11-06T13:27:04.342900+00:00

blocked by per_server_consent_policy · logged to var/telemetry.jsonl

Tool description that differed: run_demo

poisoned

Run the canonical TrustFall scenario for this mode and return the DemoResult JSON.

sanitised

Run the canonical TrustFall scenario for this mode and return the DemoResult JSON.

Vulnerable mode

violation_detected: truesecret_exfiltrated: false

✗ The attack succeeded

where it landed

var/process-ledger.jsonl
sandbox/effects/project-mcp-started-<session>.txt

trust decision

Folder trusted

True

Per server consent

False

Started server

drift-mock.project-helper

Started record

{5 keys}

Proof artifact

/app/sandbox/effects/project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt

telemetry events for this run

sandbox_file_written impact-runner → sandbox/effects/project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt allowed_by_vulnerable_mode

impact-runner: file written: project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt

permission_change_applied trustfall.project_mcp_settings → drift-mock.project-helper allowed_by_vulnerable_mode

trustfall.project_mcp_settings: project-defined MCP server 'drift-mock.project-helper' started after folder trust without per-server consent

sandbox_file_written impact-runner → sandbox/effects/project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt allowed_by_vulnerable_mode

impact-runner: file written: project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt

permission_change_applied trustfall.project_mcp_settings → drift-mock.project-helper allowed_by_vulnerable_mode

trustfall.project_mcp_settings: project-defined MCP server 'drift-mock.project-helper' started after folder trust without per-server consent

Background

A project-level mcp.json file lists MCP servers the IDE auto-connects to on open. The vulnerable client treats discovery as enablement: simply seeing a new server in the file is enough to add its tool surface to the agent. A malicious project ships its own server entry; on first open the agent silently gains the attacker's tools.

Defended mode

violation_detected: truesecret_exfiltrated: falseblocked_by: per_server_consent_policy

✓ The defense blocked the attack

where it landed

var/telemetry.jsonl

rule that fired

per_server_consent_policy

trust decision

Folder trusted

True

Per server consent

False

Started server

None

Capability diff

[2 items]

telemetry events for this run

policy_decision policy.per_server_consent_policy → drift-mock.project-helper blocked

policy.per_server_consent_policy: folder trust is not enough; per-server consent is required to start 'drift-mock.project-helper'

policy_decision policy.per_server_consent_policy → drift-mock.project-helper blocked

policy.per_server_consent_policy: folder trust is not enough; per-server consent is required to start 'drift-mock.project-helper'

Background

per_server_consent_policy decouples discovery from enablement. Every newly discovered server requires an explicit grant_per_server_consent before its tools become callable; auto-connect on open is refused and surfaced as a consent-required event.

Background on this attack class

TrustFall-style project-defined MCP onboarding demo. The mock repository ships an `.mcp.json` and a `.claude/settings.json` that point at an "additional" MCP server. Vulnerable: a single folder- trust acceptance is enough to start the project-defined server. Defended: per-server explicit consent is required after folder trust.

Developer view: raw outputs, tools/list, MCP Inspector

Vulnerable mount: http://mcp-sec.data.mayflower.tech/mcp/trustfall-project-mcp-settings/vulnerable/
Defended mount: http://mcp-sec.data.mayflower.tech/mcp/trustfall-project-mcp-settings/defended/
Open in MCP Inspector: run npx @modelcontextprotocol/inspector locally and paste either URL above as a Streamable HTTP server.

DemoResult: vulnerable

{
  "experiment": "remote-trustfall-project-mcp-settings",
  "mode": "vulnerable",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [],
  "events": [
    {
      "type": "trust_decision",
      "folder_trusted": true,
      "per_server_consent": false,
      "started_server": "drift-mock.project-helper",
      "started_record": {
        "ts": "2026-11-06T13:27:04.342305+00:00",
        "server_id": "drift-mock.project-helper",
        "origin": "project_dot_mcp_json",
        "session_id": "compare-vuln-remote-trustfall-project-mcp-settings",
        "experiment": "remote-trustfall-project-mcp-settings"
      },
      "proof_artifact": "/app/sandbox/effects/project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt"
    }
  ]
}

DemoResult: defended

{
  "experiment": "remote-trustfall-project-mcp-settings",
  "mode": "defended",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [
    "per_server_consent_policy"
  ],
  "events": [
    {
      "type": "trust_decision",
      "folder_trusted": true,
      "per_server_consent": false,
      "started_server": null,
      "capability_diff": [
        "tools/call",
        "resources/read"
      ]
    }
  ]
}

tools/list (vulnerable)

run_demo

description

Run the canonical TrustFall scenario for this mode and return the DemoResult JSON.

inputSchema

{
  "properties": {
    "session_id": {
      "default": "mcp-vulnerable",
      "title": "Session Id",
      "type": "string"
    },
    "grant_per_server_consent": {
      "default": false,
      "title": "Grant Per Server Consent",
      "type": "boolean"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}

tools/list (defended)

run_demo

description

Run the canonical TrustFall scenario for this mode and return the DemoResult JSON.

inputSchema

{
  "properties": {
    "session_id": {
      "default": "mcp-defended",
      "title": "Session Id",
      "type": "string"
    },
    "grant_per_server_consent": {
      "default": false,
      "title": "Grant Per Server Consent",
      "type": "boolean"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}

telemetry: vulnerable

[
  {
    "event_id": "evt_9d5332dcba171737",
    "ts": "2026-11-06T13:11:03.380159+00:00",
    "session_id": "compare-vuln-remote-trustfall-project-mcp-settings",
    "experiment": "remote-trustfall-project-mcp-settings",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_trustfall_project_mcp_settings_6e930de42e84d7548a8f6e1c",
      "artifact": "/app/sandbox/effects/project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt"
    }
  },
  {
    "event_id": "evt_29d12146ae7a27bb",
    "ts": "2026-11-06T13:11:03.380265+00:00",
    "session_id": "compare-vuln-remote-trustfall-project-mcp-settings",
    "experiment": "remote-trustfall-project-mcp-settings",
    "mode": "vulnerable",
    "event_type": "permission_change_applied",
    "severity": "info",
    "message": "trustfall.project_mcp_settings: project-defined MCP server 'drift-mock.project-helper' started after folder trust without per-server consent",
    "data": {
      "actor": "trustfall.project_mcp_settings",
      "target": "drift-mock.project-helper",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": null,
      "artifact": "/app/var/process-ledger.jsonl",
      "capabilities": "tools/call, resources/read"
    }
  },
  {
    "event_id": "evt_13614202d5ade954",
    "ts": "2026-11-06T13:27:04.342688+00:00",
    "session_id": "compare-vuln-remote-trustfall-project-mcp-settings",
    "experiment": "remote-trustfall-project-mcp-settings",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_trustfall_project_mcp_settings_6e930de42e84d7548a8f6e1c",
      "artifact": "/app/sandbox/effects/project-mcp-started-compare-vuln-remote-trustfall-project-mcp-settings.txt"
    }
  },
  {
    "event_id": "evt_c53c8183d2b106d5",
    "ts": "2026-11-06T13:27:04.342800+00:00",
    "session_id": "compare-vuln-remote-trustfall-project-mcp-settings",
    "experiment": "remote-trustfall-project-mcp-settings",
    "mode": "vulnerable",
    "event_type": "permission_change_applied",
    "severity": "info",
    "message": "trustfall.project_mcp_settings: project-defined MCP server 'drift-mock.project-helper' started after folder trust without per-server consent",
    "data": {
      "actor": "trustfall.project_mcp_settings",
      "target": "drift-mock.project-helper",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": null,
      "artifact": "/app/var/process-ledger.jsonl",
      "capabilities": "tools/call, resources/read"
    }
  }
]

telemetry: defended

[
  {
    "event_id": "evt_7b69254beeea886e",
    "ts": "2026-11-06T13:11:03.380374+00:00",
    "session_id": "compare-def-remote-trustfall-project-mcp-settings",
    "experiment": "remote-trustfall-project-mcp-settings",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.per_server_consent_policy: folder trust is not enough; per-server consent is required to start 'drift-mock.project-helper'",
    "data": {
      "actor": "policy.per_server_consent_policy",
      "target": "drift-mock.project-helper",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "folder trust is not enough; per-server consent is required to start 'drift-mock.project-helper'"
    }
  },
  {
    "event_id": "evt_a4dc512680eefc8d",
    "ts": "2026-11-06T13:27:04.342900+00:00",
    "session_id": "compare-def-remote-trustfall-project-mcp-settings",
    "experiment": "remote-trustfall-project-mcp-settings",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.per_server_consent_policy: folder trust is not enough; per-server consent is required to start 'drift-mock.project-helper'",
    "data": {
      "actor": "policy.per_server_consent_policy",
      "target": "drift-mock.project-helper",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "folder trust is not enough; per-server consent is required to start 'drift-mock.project-helper'"
    }
  }
]