An MCP integration starts contacting an unexpected endpoint. Its normal tool calls still work.
Treat that as a reason to investigate the artifact and its data flow. Waiting for a visibly broken response can miss the compromise.
The postmark-mcp incident demonstrates the pattern: advertised behavior can continue while data is copied through an unauthorized recipient.
Contain the path and preserve the evidence
Disable the server's access and block known malicious destinations. If process compromise is plausible, isolate the host or runner. Capture volatile evidence when feasible without delaying urgent containment.
Preserve the resolved package or image, digest, lockfile, startup command, effective configuration, tool manifest, and relevant network and downstream audit logs. Handle captured environments as sensitive evidence because they may contain secrets.
Containment and evidence capture may proceed together. Preserve enough artifact identity and runtime context to explain what ran.
Choose the investigation branch
If the server only received application data: identify which messages, documents, queries, or tool parameters reached it. Include secrets embedded in that content, not just its configured API token.
If the server executed locally: inspect process ancestry, child processes, readable files, mounted credentials, persistence, and network access. Its exposure may extend beyond the MCP transcript.
If the package ran in CI: review repository tokens, workflow changes, release artifacts, package publication, and cloud federation available during that job.
These branches can overlap. State which exposure is demonstrated and which remains possible.
Reconstruct actions with downstream records
Compare the agent's requested operation with the effective recipients, destinations, and changes recorded by the connected service.
A plausible result does not rule out hidden behavior. Email delivery logs may reveal an extra recipient. Cloud audit records may show credential use after the tool stopped. Process telemetry may show a helper launched during package installation.
Search the fleet for the same digest, publisher, endpoint, and configuration fragment. A package name alone can miss renamed or cached artifacts.
Restore an approved integration
Rotate exposed access from a clean environment, following the credential dependency order. Rebuild compromised hosts and runners from trusted artifacts.
Approve a specific replacement and compare its observed behavior with its documented purpose before reconnecting sensitive data.
Close the incident with four answers: which artifact ran, what it could access, what the evidence shows it did, and why the restored path is trustworthy. Keep unresolved exposure explicit rather than treating removal as proof of recovery.