The issue centres on Claude Code’s handling of the. mcp. json file, which allows repositories to define MCP servers used by the coding agent. These servers can launch local commands and connect Claude Code to external tools, databases and services. Because project-scoped configurations are designed to travel with a repository, changes introduced through source-control branches can carry executable MCP definitions.
Security researcher Kev Breen demonstrated that the trust decision associated with an MCP server may survive changes to the underlying configuration. A developer can initially approve a legitimate MCP server while working on a trusted branch. An attacker can then submit a pull request that alters the server’s command while retaining its previously approved identity.
When Claude Code is subsequently launched against the attacker-controlled branch, the modified MCP configuration can be started without another meaningful review of the command being executed. The result is a path from an apparently routine code-review workflow to command execution under the developer’s account.
The potential impact extends beyond alteration of source code. MCP server processes can inherit access available within the developer environment. Depending on the workstation and its configuration, that environment may contain API credentials, cloud authentication tokens, package-registry credentials, SSH authentication material and other secrets used during software development.
Anthropic’s documentation states that project-scoped MCP servers are stored in. mcp. json at the repository root and are intended to be committed to version control for use by teams. Claude Code normally asks users to approve such servers before activating them and provides a command for resetting project approval choices.
The security concern arises because approval is not necessarily reassessed when the executable content behind a trusted MCP entry changes. This creates a distinction between trusting a project at one point in time and trusting every future version of executable configuration that can appear at the same project location.
Breen said the behaviour was reported to Anthropic, which regarded it as consistent with the product’s workspace trust model rather than a conventional vulnerability requiring a separate fix. That position places greater responsibility on developers to treat changes to agent configuration files as security-sensitive code.
The disclosure is separate from CVE-2026-47751, an earlier vulnerability affecting Anthropic’s Claude Code GitHub Action. That flaw involved pull-request branches containing malicious. mcp. json configurations that could execute on GitHub Actions runners. Versions of claude-code-action before 1.0.74 were affected, while version 1.0.74 addressed the problem.
That vulnerability depended on the action checking out attacker-controlled pull-request code, reading the resulting MCP configuration and enabling project servers. A privileged or automated workflow invocation could consequently expose secrets available to the runner.
The newly highlighted scenario shifts the focus from CI infrastructure to ordinary developer workstations. Pull-request review is particularly sensitive because developers routinely inspect code originating from contributors who may have no established trust relationship with the project.
MCP has become an important component of agentic software development because it provides a standard way for AI tools to communicate with external systems. Claude Code supports local, project and user MCP scopes, with project configurations deliberately designed for team sharing.
That convenience also means configuration files can cross the same trust boundaries as source code. Unlike conventional application configuration, however, an MCP entry can specify a command that starts a process on the host system. Security teams therefore increasingly regard MCP files, agent instructions, hooks and related AI-development metadata as executable supply-chain components rather than harmless repository settings.
Developers reviewing untrusted contributions can reduce exposure by inspecting. mcp. json changes before launching Claude Code on a pull-request branch, resetting previously approved MCP choices where appropriate and avoiding persistent approval of unnecessary project servers. Organisations can also restrict which MCP servers are permitted through managed configuration and isolate sensitive credentials from coding-agent environments.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
