AG-024: High Cross-Origin Risk: Many MCP Servers Connected

What this rule means

The agent connects to four or more MCP servers (the rule's threshold), which means N*(N-1)/2 cross-server pairs sharing one context. Any server can influence the model's handling of data belonging to any other — the confused-deputy problem, once per pair.

Why it matters

The Postmark MCP rug-pull (September 2025) showed that one server in a set can turn malicious after approval; the more servers share a context, the more places that matters.

How to fix it

Split unrelated MCP servers across separate agents or sessions so untrusted and sensitive origins never share one context.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-024          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules