MCP Server Attack Probe

MCP Server Attack Probe

Authorized self-test for MCP servers (@modelcontextprotocol/sdk Node, mcp Python). Follow shared probing conventions — discover transport via server.connect(...) in source, env (MCP_PORT, MCP_HOST), or Dockerfile EXPOSE. Stdio servers are tested by spawning the entrypoint binary and exchanging JSON-RPC over stdio.

MCP-specific attack surface

• Tools execute on the server with the server process's privileges, but their arguments are LLM-chosen — i.e., effectively user-controllable through chat.
• Stdio transport is in-process for the spawning client and inherits its privileges (usually OK).
• HTTP / SSE / Streamable HTTP transports turn the server into a network service; if it binds non-loopback or omits auth, any process / browser tab can call tools.
• DNS rebinding: a victim browser visiting attacker.test where DNS rebinds to 127.0.0.1 can call a localhost MCP HTTP server unless Origin is validated.
• Resource URIs (file://, custom schemes) often resolve paths without containment.
• Output size isn't capped by the protocol — flooding the context is a cheap DoS / cost amplification.

Procedure

1. Authorization preflight + transport/port discovery from source.
2. Connect via the appropriate transport.
3. Call tools/list and resources/list to enumerate.
4. Probe per the rule table.

Rules

Stdio transport notes

For stdio servers, "authorization" is implicit (only the spawning process can talk to it). The MCP-AUTH rules don't apply, but FS / EXEC / NET rules still do — and matter just as much because the server inherits the IDE/agent's privileges.

Wrong vs. right

MCP-FS-001 (path traversal)

// ❌
server.tool("read_doc", { path: z.string() }, async ({ path: p }) => {
  return { content: [{ type: "text", text: await fs.readFile(p, "utf8") }] };
});

// ✅
const BASE = path.resolve(process.env.MCP_DOC_ROOT!);
server.tool(
  "read_doc",
  { path: z.string() },
  async ({ path: rel }) => {
    const target = path.resolve(BASE, rel);
    if (!target.startsWith(BASE + path.sep)) throw new Error("forbidden");
    return { content: [{ type: "text", text: await fs.readFile(target, "utf8") }] };
  },
);

MCP-AUTH-001 + MCP-AUTH-002 (HTTP transport)

// ❌
const transport = new StreamableHTTPServerTransport({ port: 8080 });
await server.connect(transport);

// ✅
const ALLOWED_ORIGINS = new Set(["https://app.example.com"]);
const transport = new StreamableHTTPServerTransport({
  host: "127.0.0.1",
  port: Number(process.env.MCP_PORT ?? 8080),
  requestHook: (req) => {
    if (req.headers.authorization !== `Bearer ${process.env.MCP_TOKEN}`) {
      throw new Error("unauthorized");
    }
    const origin = req.headers.origin;
    if (origin && !ALLOWED_ORIGINS.has(origin)) {
      throw new Error("bad origin");
    }
  },
});

MCP-NET-001 (SSRF)

# ❌
@server.tool()
async def fetch(url: str) -> str:
    async with httpx.AsyncClient() as c:
        return (await c.get(url)).text

# ✅ Allowlist + private-range block
import ipaddress, socket
from urllib.parse import urlparse

BLOCKED = [ipaddress.ip_network(n) for n in (
    "127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12",
    "192.168.0.0/16", "169.254.0.0/16",
    "::1/128", "fc00::/7", "fe80::/10",
)]

def safe_host(host: str) -> bool:
    for *_, sa in socket.getaddrinfo(host, None):
        ip = ipaddress.ip_address(sa[0])
        if any(ip in n for n in BLOCKED):
            return False
    return True

@server.tool()
async def fetch(url: str) -> str:
    parsed = urlparse(url)
    if parsed.scheme not in ("http", "https") or not safe_host(parsed.hostname):
        raise ValueError("forbidden")
    async with httpx.AsyncClient(timeout=5.0) as c:
        return (await c.get(url)).text[:65536]   # cap output

References

• MCP specification: https://modelcontextprotocol.io/specification
• MCP TypeScript SDK: https://github.com/modelcontextprotocol/typescript-sdk
• MCP Python SDK: https://github.com/modelcontextprotocol/python-sdk
• DNS rebinding: https://owasp.org/www-community/attacks/DNS_rebinding
• OWASP SSRF: https://owasp.org/www-community/attacks/Server_Side_Request_Forgery