Suspicious Script/Shell Writer Modifying AI Assistant MCP Config Files

Kush rana@Kushblueteamer

•updated 3 days ago•5•0•8

Detects the creation, modification, or renaming of Model Context Protocol (MCP) configuration files (such as mcp.json or claude_desktop_config.json) by shells, scripts, or downloaders, which may indicate unauthorized tool integration or persistence attempts.