Detection rules › Panther
Anthropic MCP Server Created
Detects when a new MCP (Model Context Protocol) server integration is created. Each MCP server is a new external data pathway that could be used for data exfiltration. Every new integration should be verified as approved, especially when created by external contractors or service accounts.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration | T1567 Exfiltration Over Web Service |
Rule body yaml
AnalysisType: rule
RuleID: Anthropic.Activity.MCP.Server.Created
DisplayName: "Anthropic MCP Server Created"
Enabled: true
Filename: anthropic_mcp_server_created.py
LogTypes:
- Anthropic.Activity
Severity: Medium
Description: >
Detects when a new MCP (Model Context Protocol) server integration is created.
Each MCP server is a new external data pathway that could be used for data
exfiltration. Every new integration should be verified as approved, especially
when created by external contractors or service accounts.
Runbook: |
1. Find all Anthropic.Activity events by actor:email_address in the 1 hour before and after the alert to understand the context of the MCP server creation
2. Check if actor:email_address is an external contractor (ext. domain) or internal employee, and whether they have created MCP servers in the past 90 days
3. Check if actor:ip_address is associated with known VPN/proxy services or matches previously seen IP addresses for this actor
Tags:
- Anthropic
- Configuration
- Supply Chain
Reports:
MITRE ATT&CK:
- TA0010:T1567 # Exfiltration Over Web Service
Tests:
- Name: MCP server created
ExpectedResult: true
Log:
{
"id": "activity_01ABC123",
"created_at": "2026-04-28T19:26:58Z",
"organization_id": "org_01XYZ",
"type": "mcp_server_created",
"mcp_server_id": "mcpsrv_01ABC",
"mcp_server_name": "Snowflake",
"actor": {
"type": "user_actor",
"email_address": "contractor@ext.example.com",
"user_id": "user_01ABC",
"ip_address": "10.0.0.1",
"user_agent": "Mozilla/5.0"
}
}
- Name: Non-matching event type
ExpectedResult: false
Log:
{
"id": "activity_01DEF456",
"created_at": "2026-04-28T19:26:58Z",
"organization_id": "org_01XYZ",
"type": "claude_chat_created",
"actor": {
"type": "user_actor",
"email_address": "user@example.com",
"user_id": "user_01DEF",
"ip_address": "10.0.0.2"
}
}
Detection logic
Condition
type eq "mcp_server_created"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
type | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
event_type | type |
actor_type | actor.type |
actor_email | actor.email_address |
actor_user_id | actor.user_id |
ip_address | actor.ip_address |
user_agent | actor.user_agent |
api_key_id | actor.api_key_id |
organization_id | |
ips | p_any_ip_addresses |
mcp_server_name |