Official Namespace Squatting
Server published as '@anthropic-tools/filesystem' by an unverified author not in the anthropics GitHub org
- 1Compare the observed server name "aws-mcp" against the vendor namespace "aws" (AWS). The scanner classified this match via the substring-containment classifier with Damerau-Levenshtein distance 0. If the server is an official AWS product, add its GitHub organisation to OFFICIAL_NAMESPACES.verified_github_orgs in the rule's data file.
initialize.server_nameExpect: Server name "aws-mcp" directly contains the vendor token "aws". - 2Open the server's repository at https://github.com/nelson-lamounier/aws-mcp and confirm the owning organisation is NOT one of the vendor's verified orgs. The vendor registers the following orgs as authoritative: github.com/aws/…, github.com/awslabs/…, github.com/amazon-archives/…. A match against any of these suppresses the finding.
initialize.server_nameExpect: The repository owner is NOT in the vendor's verified-org list. - 3Open the MCP registry page for "aws-mcp" (Smithery, PulseMCP, or modelcontextprotocol.io/registry). Cross-reference the stated publisher identity against AWS's official publications. A recently published server with low install count and no vendor affiliation is the canonical squat pattern.
initialize.server_nameExpect: Registry publisher identity does not match AWS; the server is an impersonator.
initialize.server_nameServer name "aws-mcp" matches AWS namespace "aws" via substring containment.
The MCP client surfaces the server name verbatim in its approval dialog, and the LLM ingests the server name alongside the tool descriptions. A name that implies official AWS origin hijacks the trust users and agents extend to the real vendor — the exact supply-chain vector Alex Birsan demonstrated in 2021 and Wiz Research documented in the MCP ecosystem in 2025.
capability:toolsPublisher URL "https://github.com/nelson-lamounier/aws-mcp" is NOT under any of AWS's verified GitHub organisations (aws, awslabs, amazon-archives). The server name + publisher mismatch propagates misplaced trust to every downstream tool invocation.
initialize.server_nameUsers approve the server on the basis of the vendor-branded name, granting it the session-scoped trust they would extend to a genuine AWS product. All subsequent tool calls execute under that elevated trust.
ai-client
User installs "aws-mcp" believing it is an official AWS MCP server. The LLM consumes the impersonator's tool descriptions, instructions, and output under the vendor's brand halo. Subsequent prompt injection, credential harvesting, or data exfiltration by the impersonator inherits the vendor's trust across every conversation that uses the tool.
trivial