A malicious pull request has the potential to turn Claude Code’s project-scoped Model Context Protocol (MCP) configuration into a trigger for code execution, which could expose developer secrets before a reviewer has a chance to evaluate the code.
Anthropic reportedly aligns this behavior with its workspace trust model, establishing the security boundary at the initial decision to trust a folder.
Researchers demonstrated a scenario in which an open-source maintainer trusts a local repository, subsequently checks out a contributor’s pull request branch, and launches Claude Code via either its command-line interface (CLI) or its VS Code extension.
If the branch includes a project-level `.mcp.json` configuration, Claude Code might read it during session startup and automatically initialize the declared MCP servers.
Claude Code RCE Flaw
Model Context Protocol (MCP) servers enable AI coding agents to access external tools and services. These can be either remote HTTP services or locally launched processes, with the latter presenting a significant risk.
A project configuration can specify a command and arguments for a local MCP server that runs under the developer’s existing operating system privileges, as reported by ImmersiveLabs.
In the proof of concept, an attacker can introduce a seemingly routine MCP entry, such as one framed as necessary development tooling, into a pull request.
When the developer opens Claude Code after switching branches, the configuration is read, and the local process begins enumerating the server’s available tools. Notably, no explicit request to review the code or invoke a tool is required.
This situation creates a dangerous supply-chain-style review scenario. A malicious payload could target credentials accessible to the current user, including environment variables, SSH keys, cloud tokens, and agent-related configurations.
The researchers noted that this behavior could occur even before an active Claude account session is established, because launching local MCP servers is independent of the sign-in state.
Anthropic’s response, included in the disclosure, states that trusting a workspace encompasses the repository’s configuration and the contents that are subsequently checked out into that directory, including other branches.
Under this model, a pull request that modifies `.mcp.json` after the folder has already been trusted does not cross a new security boundary.
This position reflects a broader workspace-trust approach: trust is assigned to the folder rather than being cryptographically linked to the exact revision or configuration files at the time of approval.
A practical concern is that source control operations can introduce executable agent configurations after the original approval, without prompting the developer again.
Anthropic’s published security guidance indicates that Claude Code employs permissions, optional sandboxing, and trust verification for first-time runs of codebases and for new MCP servers. They also recommend that users work in virtual machines (VMs) when interacting with untrusted content and verify modifications to critical files.
Defensive Actions
Development teams should consider AI-agent configuration as executable code and elevate its review in code-review policies by implementing the following measures:
- Require dedicated reviews for `.mcp.json`, `.claude/`, IDE settings, hooks, and workflow files.
- Block or alert on newly introduced project-scoped MCP servers in pull requests.
- Review agent configurations before checking out untrusted branches locally.
- Utilize isolated VMs, development containers, or constrained sandbox environments for pull request reviews.
- Restrict outbound network access and avoid exposing long-lived cloud or source control credentials in developer shells.
- Audit MCP dependencies, including packages and container images used to launch local tools.
The researcher suggested binding trust to hashes of executable configuration files, followed by a prompt to users whenever those files change. While not foolproof, this approach would make any branch-introduced MCP configuration visible before execution is permitted.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
