What runtime or dependencies are required?

The repository includes a Python script (`server.py`) for the malicious MCP server and a configuration file for Cursor AI. No other explicit dependencies are mentioned.

Where does the exfiltrated data go?

SSH public keys are sent via HTTP POST (using wget) to an attacker-controlled server. The specific server address is not listed in the README.

SSyncDev

Start a project

SSH Key Exfiltration Via MCP Tool Poisoning MCP Server

This repository demonstrates a security vulnerability in MCP (Model Context Protocol ) servers that allows for remote code execution and data

Local serverstdio

What is the SSH Key Exfiltration Via MCP Tool Poisoning MCP Server?

This repository demonstrates a security vulnerability in MCP (Model Context Protocol ) servers that allows for remote code execution and data exfiltration through

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
server.py	The malicious MCP server implementation containing the poisoned tool

Example prompts to try

“Use SSH Key Exfiltration Via MCP Tool Poisoning to server.py.”

Frequently asked questions

The attack modifies a tool’s documentation with malicious code. When an AI assistant reads this documentation, it’s manipulated into recommending a base64-encoded command that silently collects SSH public keys, exfiltrates them to a remote server, and removes evidence.