Ultra’s anomaly detection uses an LLM-as-judge approach to evaluate every MCP tool call for security risks. It runs asynchronously by default — your MCP requests are never slowed down — and maintains per-session history so the judge can spot suspicious patterns across a conversation.
Every MCP tool call is evaluated by a Claude model acting as a security judge. The judge analyzes the tool name, arguments, response, and session history to assign a risk score (0.0–1.0) and a risk level.
The security judge evaluates each tool call for these anomaly categories:
Category
What It Catches
Injection
Prompt injection, SQL injection, command injection, path traversal in parameters
Exfiltration
Data sent to unauthorized destinations, sensitive data in tool parameters
Privilege Escalation
Accessing admin tools or elevated operations without authorization context
Reconnaissance
Systematic enumeration of resources, servers, or capabilities
Unusual Pattern
Calls at unusual times, abnormal frequency, unexpected tool combinations
Data Volume
Unusually large responses or bulk data access patterns
Rug Pull
Tool descriptions containing hidden instructions or imperative commands
The judge uses the full session history — not just the current call — to detect patterns. Cross-server operations (reading from one server, writing to another) receive extra scrutiny.
The vast majority of tool calls (~99%) will score as low or medium. High and critical scores are rare and indicate genuinely suspicious behavior like prompt injection attempts, unauthorized data access, or privilege escalation.
