How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

detect-mcp-plugin-supply-chain - Skill

Name: detect-mcp-plugin-supply-chain
Author: msaad00

Imported from msaad00/cloud-ai-security-skills (skills/detection/detect-mcp-plugin-supply-chain/SKILL.md). Install upstream with npx skills add msaad00/cloud-ai-security-skills --skill detect-mcp-plugin-supply-chain. Copyright stays with the author (Apache-2.0).

detect-mcp-plugin-supply-chain

Attack pattern

An MCP server's tools/list response can advertise a tool whose JSON inputSchema itself reaches outside the trust boundary — a $ref to a remote schema URL, a default value containing a remote URL, or a description that promotes a remote endpoint. When the agent or its infrastructure resolves that schema (for input validation, for documentation rendering, for code generation, or for human review), it fetches code or content from a host the operator never authorized.

This is the plugin / tool supply-chain flavour of OWASP LLM Top 10 LLM05 Supply Chain. The poisoned link is not the tool's implementation — it is the tool's declaration.

Detection logic

Walk MCP Application Activity events from ingest-mcp-proxy-ocsf. For each tools/list response, recursively walk every inputSchema node and harvest URL-shaped strings from $ref, default, description, and string values nested inside oneOf / anyOf / allOf / properties / items.

Compare each URL's hostname against MCP_PLUGIN_ALLOWED_HOSTS (a comma- separated list, default empty). When the env var is empty, the detector fails open and prints a single stderr warning so operators notice they shipped without an allowlist. Each (session, host) pair fires once per session.

allowlist = MCP_PLUGIN_ALLOWED_HOSTS (default empty → warn + fail-open)
walk(input_schema) → collected_urls
for url in collected_urls:
    host = urlparse(url).hostname
    if host and host not in allowlist:
        emit finding once per (session, host)

Use when the user mentions LLM05, plugin supply chain, untrusted schema, or remote $ref resolution. Do NOT use as a content-security policy enforcer.

Output contract

One OCSF 1.8 Detection Finding (class 2004) per disallowed (session, host) pair. With --output-format native the skill emits the repo-owned native projection.

OCSF output populates:

finding_info.types[] = ["mcp-plugin-supply-chain", "llm-supply-chain"]
finding_info.attacks[] — MITRE ATT&CK T1195.001 Compromise Software Supply Chain (the tool's declaration is the software the agent ingests) and MITRE ATLAS AML.T0010 AI Supply Chain Compromise (Initial Access).
deterministic finding_info.uid.
observables[] — session uid, tool name, host, source field ($ref / default / description).

Usage

MCP_PLUGIN_ALLOWED_HOSTS="schema.openai.com,registry.modelcontextprotocol.io" \
  python ../../ingestion/ingest-mcp-proxy-ocsf/src/ingest.py mcp-proxy.jsonl \
  | python src/detect.py \
  > plugin-supply-chain-findings.ocsf.jsonl

Install detect-mcp-plugin-supply-chain and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "msaad00-cloud-ai-security-skills-detect-mcp-plugin-supply-chain", "kind": "skill", "name": "detect-mcp-plugin-supply-chain", "description": "Detect MCP server tools/list responses where any tool's inputSchema references a hostname not in MCP_PLUGIN_ALLOWED_HOSTS. Reads OCSF 1.8 Application Activity (class 6002) records produced by ingest-mcp-proxy-ocsf and walks the tool's JSON schema (oneOf / anyOf / allOf / properties / items / $ref / default / description) extracting every URL-shaped string. Fires once per (session, host) pair when the host falls outside the allowlist. Maps to OWASP LLM Top 10 LLM05 Supply Chain via Plugins/Tools. Use when the user mentions MCP plugin supply chain, untrusted schema $ref, LLM05, or tool inputSchema fetching remote definitions. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use as a generic URL scanner; the contract is scoped to inputSchema URLs in tools/list responses.", "publisher": "msaad00", "version": "1.0.0", "capabilities": { "domains": [ "coding", "legal" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Detect MCP server tools/list responses where any tool's inputSchema references a hostname not in MCP_PLUGIN_ALLOWED_HOSTS. Reads OCSF 1.8 Application Activity (class 6002) records produced by ingest-mcp-proxy-ocsf and walks the tool's JSON schema (oneOf / anyOf / allOf / properties / items / $ref / default / description) extracting every URL-shaped string. Fires once per (session, host) pair when the host falls outside the allowlist. Maps to OWASP LLM Top 10 LLM05 Supply Chain via Plugins/Tools. Use when the user mentions MCP plugin supply chain, untrusted schema $ref, LLM05, or tool inputSchema fetching remote definitions. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use as a generic URL scanner; the contract is scoped to inputSchema URLs in tools/list responses." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/msaad00/cloud-ai-security-skills", "path": "skills/detection/detect-mcp-plugin-supply-chain/SKILL.md", "ref": "e75c2b47895a67e7782a25587f1ef08dd341c6e7", "url": "https://github.com/msaad00/cloud-ai-security-skills/blob/e75c2b47895a67e7782a25587f1ef08dd341c6e7/skills/detection/detect-mcp-plugin-supply-chain/SKILL.md", "key": "msaad00/cloud-ai-security-skills/skills/detection/detect-mcp-plugin-supply-chain/SKILL.md" }, "license": "Apache-2.0" }, "instructions": "# detect-mcp-plugin-supply-chain\n\n## Attack pattern\n\nAn MCP server's `tools/list` response can advertise a tool whose JSON\n`inputSchema` itself reaches outside the trust boundary — a `$ref` to a\nremote schema URL, a `default` value containing a remote URL, or a\n`description` that promotes a remote endpoint. When the agent or its\ninfrastructure resolves that schema (for input validation, for documentation\nrendering, for code generation, or for human review), it fetches code or\ncontent from a host the operator never authorized.\n\nThis is the **plugin / tool supply-chain** flavour of OWASP LLM Top", "cost": { "context_tokens": 661 } }

detect-mcp-plugin-supply-chain

About

detect-mcp-plugin-supply-chain

Attack pattern

Detection logic

Output contract

Usage

Install detect-mcp-plugin-supply-chain and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Use it

Manifest

Reviews