Anthropic MCP Server Created

Last updated 5 days ago on 2026-09-21

Created 14 days ago on 2026-09-12

About

Detects the first successful creation of a Model Context Protocol (MCP) server integration name in an Anthropic organization within the rule history window. MCP servers add external data pathways into Claude and can expose organizational data to third-party infrastructure. This is a New Terms rule keyed on `organization.id` and `anthropic.audit.mcp_server_name` so the same connector name can still alert in another tenant, while routine re-creation of an already-seen name in the same organization does not.

Tags

Domain: GenAIPlatform: AnthropicData Source: Anthropic Audit LogsUse Case: Threat DetectionUse Case: UEBARule Type: New TermsTactic: PersistenceLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Software Extensions (T1176)(external, opens in a new tab or window)

False Positive Examples

Teams enable approved MCP connectors for data platforms, ticketing systems, and internal tools during Claude rollouts. Validate the server name, actor, and whether the integration matches an approved request.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-anthropic.audit-*
Related Integrations: anthropic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "anthropic.audit" and
    event.category: "configuration" and
    event.action: "mcp_server_created" and
    event.outcome: "success"

Install detection rules in Elastic Security

Detect Anthropic MCP Server Created in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).