Filtered Local Model Context Protocol (MCP) Server Execution

Josh Vaxen@JVax

•updated May 4, 2026•10•0•274

Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.