Anthropic MCP Server Created

AnalysisType: rule
RuleID: Anthropic.Activity.MCP.Server.Created
DisplayName: "Anthropic MCP Server Created"
Enabled: true
Filename: anthropic_mcp_server_created.py
LogTypes:
  - Anthropic.Activity
Severity: Medium
Description: >
  Detects when a new MCP (Model Context Protocol) server integration is created.
  Each MCP server is a new external data pathway that could be used for data
  exfiltration. Every new integration should be verified as approved, especially
  when created by external contractors or service accounts.
Runbook: |
  1. Find all Anthropic.Activity events by actor:email_address in the 1 hour before and after the alert to understand the context of the MCP server creation
  2. Check if actor:email_address is an external contractor (ext. domain) or internal employee, and whether they have created MCP servers in the past 90 days
  3. Check if actor:ip_address is associated with known VPN/proxy services or matches previously seen IP addresses for this actor
Tags:
  - Anthropic
  - Configuration
  - Supply Chain
Reports:
  MITRE ATT&CK:
    - TA0010:T1567  # Exfiltration Over Web Service
Tests:
  - Name: MCP server created
    ExpectedResult: true
    Log:
      {
        "id": "activity_01ABC123",
        "created_at": "2026-04-28T19:26:58Z",
        "organization_id": "org_01XYZ",
        "type": "mcp_server_created",
        "mcp_server_id": "mcpsrv_01ABC",
        "mcp_server_name": "Snowflake",
        "actor": {
          "type": "user_actor",
          "email_address": "contractor@ext.example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: Non-matching event type
    ExpectedResult: false
    Log:
      {
        "id": "activity_01DEF456",
        "created_at": "2026-04-28T19:26:58Z",
        "organization_id": "org_01XYZ",
        "type": "claude_chat_created",
        "actor": {
          "type": "user_actor",
          "email_address": "user@example.com",
          "user_id": "user_01DEF",
          "ip_address": "10.0.0.2"
        }
      }


# ------ paired body: anthropic_mcp_server_created.py ------

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context


def rule(event):
    return event.get("type") == "mcp_server_created"


def title(event):
    actor_email = anthropic_actor_id(event)
    server_name = event.get("mcp_server_name", "<UNKNOWN_SERVER>")
    return f"Anthropic: MCP server [{server_name}] created by [{actor_email}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)