Black Hat MEA 2026 · Arsenal

MC2P Model Command and Control Protocol

What happens when an MCP server approved by an AI host also behaves like a parent-bound C2 session?

MC2P is an open-source testbed that measures it. One executable is a local stdio MCP server for Claude Code or VS Code and, at the same time, an outbound MCP client to a private-lab controller. Every claim is backed by a hash-linked evidence chain you can replay offline.

Explore the code Read the paper
evidence replay · offline 
$ node release/verify-evidence-bundle.mjs \
    fixtures/golden/evidence-bundle.json
#0 CANARY_CREATED    f4e262806be82c51 ← null
#1 NODE_REGISTERED   074eeb86f8d6db01 ← f4e262806be82c51
#2 TASK_QUEUED       e856decb1314b47d ← 074eeb86f8d6db01
#3 TASK_POLLED       bc5476f63891402d ← e856decb1314b47d
#4 TASK_COMPLETED    1642941939176737 ← bc5476f63891402d
#5 RESULT_VERIFIED   8b8597ca6c4e1fd8 ← 1642941939176737
#6 SESSION_COMPLETED 79e1bcc73b0b9d0b ← 8b8597ca6c4e1fd8
✓ chain intact · 7 events · verdict RESULT_VERIFIED
bundle sha256 9b27fc12ce59253f…297f2cd1da90c8a4
Real hashes from the checked-in golden bundle.

The research question

Approving an MCP server approves a process lifetime, not just a tool list.

Most MCP security work studies what the model sees: poisoned tool descriptions, prompt injection, malicious skills. MC2P studies the executable underneath. Once a user clicks approve, the host is allowed to:

  • START

    Launch it

    The host starts the server and completes discovery before any tool is called.

  • KEEP

    Keep it alive

    The process lives as long as its parent IDE session keeps stdio open.

  • CONNECT

    Let it reach out

    It can open network connections, subject only to host controls.

  • RESTART

    Start it again

    Every later approved session launches it again, with no OS persistence needed.

Architecture

One process. Two protocol roles.

MC2P is not a new wire protocol. It composes two standard MCP roles inside one visibly installed process and makes every step of that relationship measurable.

Controller destination
Loopback by default. Anything else needs an explicit RFC1918 allowlist.
Enrollment
One-use bootstrap bound to a node ID and capability digest, exchanged for a revocable identity.
Lifetime
Owned by the MCP host. No autostart, no service, no scheduled task.
Operator API
Bearer token required, even on loopback.

Session lifecycle

From a visible approval to a linked reconnect.

Each step emits an event into the chain, in this order.

  1. Visible install and approval

    APPROVED_MANIFEST

    The operator installs an mc2p-lab-* entry and the host shows its trust prompt. MC2P never scripts that prompt.

  2. Host starts the process

    PROCESS_STARTED → MCP_INITIALIZED → TOOLS_LISTED

    Discovery completes with zero tool calls. The model never asked for this process to run.

  3. Enrollment

    NODE_REGISTERED

    The one-use bootstrap is consumed and replaced by a revocable node identity in an owner-only file.

  4. Heartbeat and polling

    HEARTBEAT · TASK_POLL_EMPTY

    A fixed 3000 ms empty-poll cadence proves a live outbound transport, separate from a live IDE session.

  5. Fixed, leased task

    TASK_QUEUED → TASK_POLLED

    Tasks are bound to a run, node, capability digest, opcode, deadline and lease.

  6. Typed result

    TASK_COMPLETED → RESULT_VERIFIED

    A result is promoted only when the same run, node and task chain lines up with the expected artifact digest.

  7. Parent closes

    PARENT_LOST

    Closing the IDE ends stdin and the node exits. In the recorded run, zero node processes remained 1,299 ms later.

  8. Linked reconnect

    SESSION_RECONNECTED

    The next approved start opens a new session whose previousSessionId points at the one that ended.

Bounded by design

Five fixed opcodes. No command strings.

The public executor takes no shell text and no executable path. This is the entire task surface.

GET_SYSTEM_INFO

Bounded platform metadata.

no process execution
LIST_DEMO_FILES

Lists synthetic fixture names.

confined to the lab root
READ_CANARY

Hashes a generated synthetic canary.

digest, not file contents
WRITE_MARKER

Writes a deterministic run marker.

path containment + journal
LAUNCH_CALCULATOR_DEMO

Opens Windows Calculator for a visible proof.

opt-in · zero arguments

Not in the public build

  • arbitrary shell
  • executable selection
  • credential collection
  • persistence
  • stealth install
  • unrestricted file transfer
  • public callback default

Evidence before claims

A window opening on a VM proves nothing. A verified chain does.

State changes and evidence are written in the same SQLite transaction. Each event carries the hash of the one before it. The verdict is recomputed independently in Node.js and in the browser with WebCrypto.

  1. #0CANARY_CREATEDf4e262806be82c51prev null
  2. #1NODE_REGISTERED074eeb86f8d6db01prev f4e26280
  3. #2TASK_QUEUEDe856decb1314b47dprev 074eeb86
  4. #3TASK_POLLEDbc5476f63891402dprev e856decb
  5. #4TASK_COMPLETED1642941939176737prev bc5476f6
  6. #5RESULT_VERIFIED8b8597ca6c4e1fd8prev 16429419
  7. #6SESSION_COMPLETED79e1bcc73b0b9d0bprev 8b8597ca
307chained events in the clean-VM S00–S10 run
2independent verifiers: Node.js and browser
5evidence gates closed on real Claude Code hosts
0network calls needed to replay a bundle
  • M00 explicit enrollment
  • M01 task-free lifecycle
  • M02 parent-bound shutdown
  • M03 linked restart
  • M04 clean-VM S00–S10

Failed attempts stay in the record next to the passes. Nothing is relabeled.

MC2P Control

An operator view that does not lie about liveness.

The dashboard keeps three states apart that C2 demos often blur together.

  • Enrolled a revocable node identity exists
  • Connected a recent authenticated heartbeat proves the transport
  • Live IDE session the node is attached to an observed host session
MC2P Control dashboard replaying the golden READ_CANARY evidence bundle offline

Scope

What MC2P is, and what it is not.

MC2P is

  • A dual-role MCP lifecycle research testbed
  • A bounded, typed task-and-result system
  • A private-lab controller and operator dashboard
  • A reproducible evidence and release pipeline
  • A way to find detection points below the tool-description layer

MC2P is not

  • An initial-access technique
  • A general-purpose remote shell
  • An Internet callback service
  • A stealth or persistence framework
  • A claim that prompt and skill attacks don't matter

See it live

Black Hat MEA 2026 · Arsenal

Dates
1–3 December 2026
Venue
Riyadh Exhibition & Convention Centre, Malham
Station
Published with the Arsenal schedule

The live demo walks through a Claude Code approval, automatic enrollment, a fixed task round trip, parent loss, a linked reconnect, and an offline replay of the resulting evidence.

Doors open in

--days
--hrs
--min
--sec

Try it

Verify the evidence yourself in under a minute.

No controller, no VM, no network. Clone, test, and replay the golden bundle.

PowerShell · bash 
git clone https://github.com/Kuvvett/mc2p.git
cd mc2p
pnpm install --frozen-lockfile
pnpm build
node release/verify-evidence-bundle.mjs fixtures/golden/evidence-bundle.json