Scoring Repos Before Cloning: Stop Fake MCP Servers

Scoring Repos Before Cloning: Stop Fake MCP Servers

Engineering workflows have shifted rapidly toward autonomous coding assistants and extensible model architectures. Developers routinely instruct tools to find integrations, install external packages, and attach new tools via the Model Context Protocol (MCP). However, accepting external repositories without scrutiny has introduced severe supply chain vulnerabilities into local development machines and production environments.

Recent threat intelligence demonstrates that malicious actors are weaponizing repositories specifically crafted to deceive both human engineers and automated assistants. Instead of relying on obvious trojans, attackers create believable personas, distribute malicious MCP servers, and manipulate assistant recommendations to slip malicious payloads directly into developer workstations.

To protect environments from these vectors, engineering organizations must introduce automated validation into their onboarding and package selection routines. Pre-flight evaluation and scoring repos before cloning provide a critical defensive boundary between automated agent recommendations and local command execution.

The Evolution of FakeGit and AgentBaiting Campaigns

Threat campaigns are now directly targeting the emerging AI development stack. Security researchers at Island uncovered an extensive operation designated as FakeGit, which comprised roughly 7,600 malicious GitHub repositories linked to approximately 6,600 fake publisher profiles. Across its release assets, the campaign accumulated more than 14 million downloads. Crucially, over 800 of these repositories masqueraded as AI skills or MCP servers—the precise building blocks teams are adopting to expand model capabilities.

The threat extends beyond manual developer error through a mechanism researchers identified as AgentBaiting. In documented security tests, leading assistants including Claude Code, Gemini, and ChatGPT surfaced and recommended malicious repositories independently, without an engineer providing an explicit external link. For instance, prompting an agent to source a free Walmart MCP server resulted in the assistant selecting an attacker-controlled repository as its top recommendation. The agent parsed the deceptive documentation as legitimate instructions and presented it to the developer with implicit trust.

This pattern flips classic social engineering on its head. In typical supply chain attacks, developers fall for spoofed package names through typosquatting. Under AgentBaiting, the developer’s trusted assistant acts as the endorser, surfacing malicious repositories that the underlying language model never fundamentally vetted or audited.

Analyzing the Attack Surface: Beyond the Source Code

Malicious repositories rarely present their threats directly inside readable functional logic. Instead, attackers plant risks into the initial installation steps and environment configuration routines that engineers run on faith. The primary threat delivery mechanisms consistently focus on shell executions, package postinstall hooks, and archive binaries.

The danger of unmonitored setup actions was demonstrated by SANDWORM_MODE in February 2026, documented by Socket. This worm dropped rogue MCP servers directly into local AI assistant configurations across tools like Claude Desktop, Cursor, VS Code Continue, and Windsurf. Once implanted, the rogue servers harvested API credentials across nine LLM providers straight from developer environments.

Similarly, the GhostAction campaign documented by GitGuardian in October 2026 compromised around 1,900 GitHub accounts and struck over 30,000 repositories in a single burst. The payload attempted to exfiltrate 3,174 secrets from CI pipelines, hunting for credentials across npm, PyPI, DockerHub, and major AI provider keys. These attacks prove that running arbitrary installation routines poses immediate risks to organization-wide infrastructure.

Designing a Pre-Clone Verification Framework

To counter rogue skills and fake repositories, teams need objective criteria rather than intuitive assessments. A viable defensive model is illustrated by RepoPilot, an open-source evaluation agent built to assess repositories before a clone command executes. The engine calculates a composite 0 to 100 score across five weighted dimensions, anchoring every decision to verifiable metadata and repository files rather than subjective model output.

Two evaluation dimensions carry the bulk of defensive weight against current threat campaigns:

Safety: This vector analyzes setup commands and documentation for malicious installation patterns, such as pipe-to-shell instructions or unverified binary downloads. A critical issue detected here caps the repository’s total score regardless of how well the functional code appears to work.
Trust: This vector identifies artificial reputation signals. FakeGit relied heavily on one-character-off usernames and small star footprints to appear legitimate. By inspecting publisher history, account creation recency, and star generation timelines, automated scanners catch mismatches between repo reputation and account age.

Importantly, a defensive scoring system must remain objective even when evaluating popular tools. For example, pointing RepoPilot at ollama/ollama results in a score reduction to a D grade. This does not indicate malware, but rather flags the official installation command curl -fsSL https://ollama.com/install.sh | sh because it pipes remote scripts directly into the local shell. Objective tools prompt engineers to review scripts before execution rather than adopting blind trust.

Architecture for Automated Repository Inspection

When building an internal verification system for incoming open-source components, software teams must separate deterministic rule evaluation from language model reasoning. Relying on an LLM to assign arbitrary security grades introduces hallucinations into security policies.

A proven architectural design utilizes AWS serverless infrastructure to maintain isolation and speed during repository scans:

Compute Layer: AWS Lambda running python3.12, exposed via Amazon API Gateway to handle inbound scan requests from developer tooling or CI checks.
Deterministic Engine: Seven specialized pure-Python tools that extract raw metadata, inspect package manifests, detect tool versions, and compute the 0 to 100 score deterministically.
Narrative Layer: Amazon Nova Pro via Amazon Bedrock, which interprets the deterministic metrics, summarizes flags into plain English, and provides structured onboarding guidance.
Local Integration: The Strands Agents SDK to drive local CLI workflows, ensuring developers can trigger checks directly from their terminal before invoking git clone.

This split ensures that all security-critical checks—such as finding hidden postinstall commands or profiling account ages against fake profile indicators—are unit-tested and reproducible, while the AI model is restricted to summarization and onboarding narration.

Key Takeaways for Securing Developer Workflows

Implement pre-clone evaluation: Adopt automated checks that evaluate repository safety, publisher history, and installation vectors before any engineer or assistant clones untrusted code.
Audit local MCP assistant configurations: Regularly inspect client configuration files in Cursor, Claude Desktop, Windsurf, and VS Code Continue to ensure unauthorized MCP servers have not been registered locally.
Ban direct shell piping: Eliminate commands like curl ... | bash and uninspected postinstall routines from standard workflows; inspect script contents prior to execution.
Validate publisher footprints: Vet the GitHub user profile behind third-party tools, checking for suspicious creation dates, low commit footprints, and typosquatted organization handles.
Protect CI and local credentials: Store LLM provider keys and registry tokens in isolated secret managers to mitigate exfiltration vectors like GhostAction and SANDWORM_MODE.

Planning something like this? XORGEEK designs and builds web and mobile apps for teams in Japan and around the world. Talk to us.