lintai docs

Appearance

Rule Reference

SEC730lintai-ai-securitystablejsonwarn

MCP config: keylogger exfiltration

MCP configuration command captures and exfiltrates keystrokes or keyboard input

Provider
lintai-ai-security
Surface
json
Scope
per_file
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership
mcpmembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Checks committed MCP launch paths for explicit keystroke capture utilities or keylogger markers combined with remote transfer behavior.

Deterministic signal basis

JsonSignals command-plus-args analysis over ArtifactKind::McpConfig for explicit keylogger primitives such as `logkeys`, `xinput test`, `evtest`, `showkey`, PowerShell `GetAsyncKeyState`, or inline Python listener markers like `pynput.keyboard.Listener`, combined with remote sinks such as `curl`, `wget`, `scp`, `rsync`, `nc`, or HTTP(S) endpoints.

Malicious corpus
mcp-command-keylogger-exfil
Benign corpus
mcp-safe-basic
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cjsonstable
SEC302Config: insecure HTTP endpointConfiguration contains an insecure http:// endpointjsonstable
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesjsonstable
SEC304Config: TLS verification disabledConfiguration disables TLS or certificate verificationjsonstable
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuejsonstable
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesjsonstable

Why It Matters ​

Capturing keyboard input and sending it to a remote destination is high-confidence surveillance and credential theft behavior.

What Triggers ​

SEC730 matches MCP commands that invoke explicit keylogger primitives such as logkeys, xinput test, evtest, showkey, PowerShell GetAsyncKeyState, or inline Python listener markers like pynput.keyboard.Listener, and also transmit data to remote sinks such as curl, wget, scp, rsync, nc, or HTTP(S) endpoints.

False Positives ​

Shared committed MCP launch paths should not capture and transmit keyboard input. Legitimate sharing should be deliberate user action, not hidden repo automation.

Remediation ​

Remove keystroke capture and remote transfer behavior from the committed MCP launch path and keep keyboard data local unless the user explicitly chooses to share it.