Appendix H: Incident Pattern Catalog
Each row is an incident class, not an advisory. “Public example” links the real case in Chapter 21.
The Catalog
| Pattern | Typical symptom | Likely blast radius | Detection signal | First containment move | Controls | Public example (ch21) |
|---|---|---|---|---|---|---|
| Over-broad command execution | Arbitrary or surprising side effects | Host compromise, secret exposure | Unexpected child processes | Disable or isolate the execution tools | Intent-shaped tools, approvals, sandboxing | — |
| Cross-tenant scope failure | User sees or mutates another tenant’s data | Severe multi-customer exposure | tenant on the event differs from the token’s tenant; support escalation | Contain the tenant path; freeze shared writes | Tenant from the token, carried into every cache key and job; hostile-path tests | Asana |
| Untrusted metadata driving local execution | A client or bridge runs a command after connecting to a server | Code execution on the operator’s machine | New child processes from the MCP client; odd URL schemes in discovery responses | Stop connecting to the server; patch the client | Parse URLs, allow https: only, launch helpers without a shell | mcp-remote |
| Developer tooling exposed | A dev proxy or Inspector reachable beyond localhost | Workstation compromise | Listener on 0.0.0.0; unexpected inbound connections | Kill the tool; rebind to loopback | Loopback by default, ephemeral local tokens, pinned versions | MCP Inspector |
| Filesystem overexposure | Model can read paths outside the allowed roots | Local secret leakage, privacy failure | Reads of paths outside the allowlist; leaked paths in outputs | Tighten path allowlists or disable filesystem access | Resolve symlinks and normalize before the prefix check | Filesystem reference server |
| Hostile configuration | A shared agent, server card or proxy setting reroutes traffic | Stolen prompts, keys and uploads | Unknown proxy or endpoint in imported config | Remove the config; rotate exposed keys | Validate and hash imported definitions | AgentSmith |
| Token or secret leakage | Credentials appear in logs or tool responses | Account compromise | Secret-scanning alert, suspicious downstream usage | Revoke credentials; preserve evidence | Logging discipline, output review, no token passthrough | — |
| Prompt-injection-driven tool misuse | Untrusted content causes dangerous actions | Data exfiltration, policy bypass, unsafe writes | Sudden unusual tool chain after reading hostile content | Disable risky tools or force approvals | Taint tracking, approval on writes after untrusted reads | — |
| Weak approval boundaries | Users can’t tell what a tool will really do | Unsafe execution with false trust | User confusion, near-miss reports | Restrict or relabel the tools | Honest annotations, approval prompts that show the action | — |
| Queue or task context loss | Asynchronous work runs under the wrong scope | Wrong-user or wrong-tenant side effects | Backlog anomalies, delayed wrong-target actions | Pause task intake; inspect task metadata | Principal and tenant stored on every job | — |
| Logging overcollection | Sensitive data lands in logs or analytics | Broad internal exposure | Log audit, leaked PII in dashboards | Stop ingestion; tighten filters | Event schema with an explicit exclusion list (ch23) | — |
Questions to Ask During Review
For each tool, resource, prompt or task path:
- What trust boundary does this cross?
- What identity, tenant, or approval context does it depend on?
- What happens if hostile or misleading content reaches this path?
- What would the logs, traces, and metrics show after misuse?
- What is the fastest safe containment option?
- Can one tenant or environment be isolated without taking down everything?
Answer question 5 before exposing the server.
Near-Miss Review Template
Use it for near-misses too: they reveal the same weaknesses at a smaller blast radius.
- Summary:
- Affected tool, resource, or task path:
- Trust boundary involved:
- Identity and tenant impact:
- Detection signal:
- Immediate containment:
- Root cause:
- Missing control or weak assumption:
- Permanent corrective action:
- Tests or runbook updates added: