AI MCP / Connector Risk

Detects risky MCP / plugin / connector descriptors: tool manifests requesting over-broad or unexplained scopes, or encouraging autonomous action that bypasses user approval (OWASP LLM06 / Agentic Top 10). Phrase detection is corroborated by AI-context markers.

Type: regex
Confidence: low
Confidence justification: Low by design. Broad-scope and approval-bypass language is common and benign in developer prototypes, sandbox tools and public sample manifests (the named FP traps). The hybrid approach pairs this seed with manifest/scope analysis; the keyword phrase alone is necessary-not-sufficient.
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
Frameworks: ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Data categories: emerging, security
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)(?:\b(?:scopes?|permissions?|access)\b[^.\n]{0,30}\b(?:\*|all|full|read[- ]?write\s+everything|admin)\b|\bwithout\s+(?:user\s+)?(?:approval|confirmation|consent)\b)

Corroborative evidence keywords

connector, plugin, manifest, tool, [object Object], artificial intelligence, [object Object], large language model, Copilot, chatbot, assistant, agent, prompt, system prompt, tool call, completion, model

Proximity: 300 characters

Should match

Permissions requested: full access. — Low-tier probe - broad grant without connector-manifest context
MCP tool manifest requests access: full admin for calendar operations. — Medium-tier probe - privileged grant in a connector manifest without approval bypass
Connector manifest requests access: read-write everything and executes without user approval. — High-tier probe - manifest context, privileged grant, and explicit approval bypass

Should not match

The connector requests read-only access to the calendar. — Narrow, scoped permission (FP trap)
This plugin reads a single document only after the user clicks Approve. — Scoped, approval-gated sibling connector
Public security guidance: an MCP tool manifest must not request access: full admin without user approval. — Public risk guidance quotes the complete risky shape
Template example: connector manifest requests access: full admin without user approval. — Explicit template containing otherwise high-tier evidence

Known false positives

Developer prototypes, sandbox tools, and public sample manifests that legitimately request broad scopes or describe autonomous action for demonstration purposes. Mitigation: Require AI-context corroborative markers within the proximity window and treat single phrase hits as low confidence; exclude known sample/template manifests.
Documentation and security guidance that quotes broad-scope or approval-bypass language when explaining the risk rather than configuring a real connector. Mitigation: Layer with manifest/scope analysis and confirm the language appears in an actual tool definition, not prose about tool definitions.

References

Collections

AI Threat Classifiers