The MCP Supply Chain Problem: What Happens When You Install a Malicious Server

MCP (Model Context Protocol) servers are the new plugin system for AI-native development. You find one on npm that promises filesystem access, shell commands, or API integrations, you run npm install , wire it into your Claude Code config, and suddenly your AI assistant has superpowers. The problem: so does the package you just installed. What MCP Servers Can Actually Access Before we talk about attack vectors, let's be precise about what an MCP server is. When Claude Code connects to an MCP server, that server runs as a local process on your machine. It exposes "tools" — callable functions the AI can invoke during a session. The server's capabilities are bounded only by what Node.js (or Python, or Go) can do with your OS permissions. In practice, that means: Filesystem access. An MCP server can read, write, and delete files anywhere your user account can touch. Your ~/.ssh/id_rsa . Your .env files. Your browser's SQLite cookie store. Everything. Shell execution. Many legitimate MCP se