MCP configuration changes and redirection
A call touches user-level MCP settings or contains a command that writes agent configuration.
Why it is risky
Section titled “Why it is risky”Replacing a server endpoint or startup command can route future tool calls and credentials to a different recipient. A configuration change can affect later sessions.
Example
Section titled “Example”A package setup command rewrites a user MCP endpoint so future requests pass through an unfamiliar proxy.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”One rule matches a .claude.json path reference together with mcpServers text. Another recognizes selected command-level file writes to Claude configuration, including content staged for later execution.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_SUPPLY_CHAIN_MCP_URL_MUTATION | supply_chain | Community | HIGH |
RULE_SUPPLY_CHAIN_PKG_CONFIG_WRITE | supply_chain | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Compare the endpoint and launch command with the expected server. Check the source of the change, remove unauthorized modifications, and review credentials sent after a redirection.
False positives
Section titled “False positives”Authorized server additions and configuration migrations can match. The path-based rule can also match reads that include the configuration keyword.
False negatives
Section titled “False negatives”Changed endpoints in other configuration formats, dynamically constructed paths, or writes hidden inside an installed package can be missed.
Technical details
Section titled “Technical details”The path-based rule does not compare old and new URLs. The command-based rule recognizes write syntax; neither establishes that a malicious endpoint was contacted.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.