---
id: 3820
title: "Otto-Support - Supply Chain Risks in MCP Servers"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/otto-support-supply-chain-risks-mcp-servers"
published_at: "2026-05-13 00:00"
tags: ["ai-security", "supply-chain", "mcp", "clawhub", "postmark-mcp", "version-pinning"]
phying_url: "https://phying.com/item/3820"
lang: en
---

# Otto-Support - Supply Chain Risks in MCP Servers

## Summary

MCP supply chain risk, made concrete: a live module shows what a hostile server reads from a developer machine, alongside the postmark-mcp hidden-BCC incident and malicious ClawHub skills.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2026-05-13 00:00
- **Original:** https://bishopfox.com/blog/otto-support-supply-chain-risks-mcp-servers
- **Phying News:** https://phying.com/item/3820