MCP Server Spoofing Attack

An attack targeting the MCP protocol in which an adversary deploys a malicious MCP server disguised as a legitimate service. Exploiting the assumption that AI agents trust servers by default, the attacker deceives agents into submitting credentials or invoking fake tools, thereby stealing sensitive information such as API keys, access tokens, and user data.