title: MCP STDIO Server Spawned by AI Coding Assistant
id: 22733efb-4557-41a3-b01f-6e1686e566df
status: experimental
description: Detects an AI coding assistant process spawning a local MCP server over STDIO transport (npx/node/python/uvx with MCP arguments, including mcp-remote). STDIO transport gives the MCP server the full privileges of the assistant process; malicious or trojanized servers (2026 MCP supply-chain incidents, e.g. the Ox Security CVE cluster around STDIO command execution) therefore inherit them silently. Hunting rule — expect noise in developer environments.
references:
    - https://media.defense.gov/2026/Jun/02/2003943289/-1/-1/0/CSI_MCP_SECURITY.PDF
    - https://github.com/7WaySecurity/ai_osint/blob/main/detection-rules/SIGMA_RULES.md
    - https://labs.cloudsecurityalliance.org/agentic/csa-research-note-atlas-agentic-gap-analysis-20260327/
author: Agentic Threat Lab
date: 2026-10-22
tags:
    - attack.execution
    - attack.t1059
atlas:
    - AML.T0053
    - AML.T0095
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\code.exe'
            - '\cursor.exe'
            - '\claude.exe'
            - '\windsurf.exe'
            - '\aider.exe'
    selection_child_mcp:
        CommandLine|contains:
            - 'mcp'
            - 'mcp-remote'
    condition: selection_parent and selection_child_mcp
falsepositives:
    - Legitimate MCP server startup — this is the normal mechanism for local MCP servers; hunt and baseline first
    - Command lines containing 'mcp' as a substring of unrelated words (consider word-boundary field mappings on your backend)
level: low