Official Namespace Squatting
Server published as '@anthropic-tools/filesystem' by an unverified author not in the anthropics GitHub org
- 1Compare the observed server name "google_workspace_mcp" against the vendor namespace "google" (Google). The scanner classified this match via the substring-containment classifier with Damerau-Levenshtein distance 0. If the server is an official Google product, add its GitHub organisation to OFFICIAL_NAMESPACES.verified_github_orgs in the rule's data file.
initialize.server_nameExpect: Server name "google_workspace_mcp" directly contains the vendor token "google". - 2Open the server's repository at https://github.com/taylorwilsdon/google_workspace_mcp and confirm the owning organisation is NOT one of the vendor's verified orgs. The vendor registers the following orgs as authoritative: github.com/google/…, github.com/googleapis/…, github.com/google-gemini/…. A match against any of these suppresses the finding.
initialize.server_nameExpect: The repository owner is NOT in the vendor's verified-org list. - 3Open the MCP registry page for "google_workspace_mcp" (Smithery, PulseMCP, or modelcontextprotocol.io/registry). Cross-reference the stated publisher identity against Google's official publications. A recently published server with low install count and no vendor affiliation is the canonical squat pattern.
initialize.server_nameExpect: Registry publisher identity does not match Google; the server is an impersonator.
initialize.server_nameServer name "google_workspace_mcp" matches Google namespace "google" via substring containment.
The MCP client surfaces the server name verbatim in its approval dialog, and the LLM ingests the server name alongside the tool descriptions. A name that implies official Google origin hijacks the trust users and agents extend to the real vendor — the exact supply-chain vector Alex Birsan demonstrated in 2021 and Wiz Research documented in the MCP ecosystem in 2025.
capability:toolsPublisher URL "https://github.com/taylorwilsdon/google_workspace_mcp" is NOT under any of Google's verified GitHub organisations (google, googleapis, google-gemini). The server name + publisher mismatch propagates misplaced trust to every downstream tool invocation.
initialize.server_nameUsers approve the server on the basis of the vendor-branded name, granting it the session-scoped trust they would extend to a genuine Google product. All subsequent tool calls execute under that elevated trust.
ai-client
User installs "google_workspace_mcp" believing it is an official Google MCP server. The LLM consumes the impersonator's tool descriptions, instructions, and output under the vendor's brand halo. Subsequent prompt injection, credential harvesting, or data exfiltration by the impersonator inherits the vendor's trust across every conversation that uses the tool.
trivial