orchid-mcp-server-compromise — supply-chain tamper on self-hosted MCP
Orchid Research Collective orchid-lab-db-mcp on mcp-orchid-01 — ten-minute window 2026-05-18 where supply-chain tamper replaces the server binary, registers inventory.export_bulk, grants /var/export, diverges client/server tool_call_id tc-00011, rewrites two tool-result payloads, and invokes postgres.copy_to the client never requested. Fully synthetic.
smoke-honest finding counts
four ndjson primaries emit one structured finding per row (24 · 24 · 8 · 24) with named reasons for client/server divergence · tool-result injection · disputed attribution. permission-escalation and call-graph engines still fan out via scanJson as documented in incident-context.json. compare golden zip before treating graph or grant counts as independent incident beats.
what this proves
- all six MCP primary engines produce deterministic, fixture-locked output on the orchid synthetic server compromise packet.
- every output runs 100% locally — audit logs and attribution exports never upload.
- client/server divergence on tc-00011 · grant-00002 /var/export · n-copy-export branch · tr-00004/tr-00006 tool-result rewrites · deployed binary hash mismatch vs signed manifest.
primary engines locked to this fixture
build the case binder
runs all six primary engines on the synthetic evidence zip and opens a self-contained html binder. no upload.
runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload
download the synthetic evidence
MIT-licensed, fully synthetic. mcp server audit · client invocation log · permission ledger · call graph · tool-result payloads · anthropic attribution · oauth grants · server binary manifest · postgres snapshot · chain of custody.
built deterministically from scripts/fixtures/build-orchid-mcp-server-compromise.mjs. seed: orchid-mcp-server-compromise:v1.
methodology
MCP server compromise triage starts with hashed server audit and client invocation exports, then walks the six primary parsers before platform security freeze narrative. not live runtime inspection. read the full MCP server compromise guide →