MCP & AI-Agent Exposure Audit
Final Report

Evidence. The postgres-mcp entry distributed via the infra-tools repo embeds a plaintext connection string for a shared role with write access to the primary. The credential has not rotated in 412 days and appears in 23 checked-out configs:

"postgres": {
  "command": "npx", "args": ["-y", "postgres-mcp"],
  "env": { "DATABASE_URL": "postgres://app_shared:▮▮▮▮▮▮▮▮▮▮▮▮@db-prod-▮▮▮.meridian.internal:5432/meridian" }
}

Impact. Any prompt-injected or misbehaving agent session on any of 23 laptops can read or modify production data. Any laptop compromise yields the credential directly.

Remediation. Rotate immediately; replace with per-developer short-lived credentials (IAM auth or Vault dynamic secrets); point the MCP server at a read replica with a least-privilege role.

Evidence. The internal deploy-helper server exposes apply_manifest with a cluster-admin kubeconfig. Tool calls are not logged anywhere; the only record is the agent conversation on the developer's machine. A deployment triggered this way is indistinguishable from a manual one in cluster audit logs.

Impact. An agent can modify production workloads, and the org cannot reconstruct what an agent did after the fact — the exact incident-response gap described in the engagement brief.

Remediation. Gate destructive tools behind explicit confirmation; scope the kubeconfig to a namespaced role; log every tool call (request, arguments, outcome) to the SIEM — §4 gives the vendor-neutral pattern.

Evidence. s3-mcp authenticates with an IAM user access key (688 days old) granting s3:* on production buckets, including DeleteObject, used from developer laptops.

Remediation. Replace with role assumption + short-lived session credentials; strip delete permissions; enable bucket versioning and object lock on the two buckets holding customer manifests.

Evidence. 8 of 11 servers launch as npx -y <package> with no version pin and no integrity check — every agent session executes whatever the registry serves that day, with the credentials in that server's env block.

Remediation. Pin exact versions; mirror vetted packages in the internal registry; prefer single-binary servers where available.

Evidence. The vendor-hosted jira-mcp (SSE) delivers tool descriptions at runtime. Descriptions are rendered into every agent's context unreviewed; a malicious or compromised description can steer agent behavior across all connected developers simultaneously.

Remediation. Snapshot and diff tool descriptions in CI; alert on changes; treat description changes as a change-management event.

Evidence. No team owns the MCP surface. 7 servers were unknown to security before this audit; 3 had no identifiable owner at all and were attributed via git blame on the introducing commit (▮▮▮▮▮▮▮▮▮).

Remediation. Add MCP servers as an asset class in the register; require an owner and a capability declaration per server; review quarterly. A one-page policy template is included in Appendix C.