Kiro Let a Web Page Rewrite the Configuration That Starts MCP Commands

Protect the global MCP configuration and the parent paths needed to prevent rename, replacement and symlink bypass, using an OS/managed-VM boundary the agent's user cannot undo. Deny direct writes and permit only an independent controlled writer with exact approved bytes and pre/post readback. A file-only ACL or an agent-owned directory is insufficient if the agent can replace the protected pathname. Test write, delete, rename, path replacement, symlink and alternate configuration paths before claiming prevention.

Preserve the exact poisoned `~/.kiro/settings/mcp.json` and referenced executable for investigation, remove the entry from every affected profile, and verify the file no longer reloads it. A running MCP child is a separate live process: stop it through endpoint response and verify its executable and process generation, because editing the configuration alone does not terminate an already launched child.

A controlled client must locally verify the exact signed configuration, approved deployment and pinned trust root before each dynamic reload, then apply the verified bytes atomically. Reject unsigned or stale changes before starting an added MCP executable. Stock Kiro does not expose this gate, so this is a vendor or controlled-client requirement; do not present ordinary notification or endpoint polling as equivalent pre-execution enforcement.

Require an independent pre-write approval bound to exact configuration bytes and the executable effect before a controlled client writes global MCP settings. A page-fetch approval or post-write notification cannot authorize this action. Stock Kiro does not expose the signed independent gate in G001; supervised permissions are supporting controls, while OS-enforced protected paths remain the reader-owned boundary. Treat the full gate as a vendor or controlled-client implementation requirement.

Discover every managed MCP configuration and the complete instruction/plugin package trees the configured loader can reach; capture exact executable/version/member digests and reconcile them with authoritative approval and ownership records. A command-string or mcp.json hash alone is not a complete package inventory. Missing host collectors or unreadable paths leave coverage unresolved. This produces findings and an exact eviction population, not approval or prevention.

Monitor managed endpoints for changes to `~/.kiro/settings/mcp.json` and compare each new command and executable digest with an approved inventory. An ordinary after-write alert is detective: Kiro can reload and launch the entry before quarantine arrives. Count this as prevention only if the endpoint product synchronously blocks the write or process start before Kiro consumes it; otherwise investigate and evict the active child separately.

Run the client and all spawned MCP processes inside a verified managed VM or supported OS sandbox with restricted project writes, no developer-home credentials and independently enforced outbound policy. This limits authority after an injected command starts. The research callback was local: an external-destination allowlist alone does not block loopback inside the same sandbox. Verify runtime isolation and local/remote routes separately; do not substitute a deprecated macOS sandbox-exec smoke test for a production boundary.

After confirming an injected MCP command, independently inventory and terminate every affected client/server process generation using PID, start time, executable digest and authoritative process state. Verify absence before restarting from reviewed configuration. Removing mcp.json persistence does not terminate a child already running; this control owns runtime termination while E-003.003 owns the startup source.