rwcod MCP Server / Tool Pentest
Authorized testing of MCP servers and tool handlers. Read ../../SECURITY_RULES.md first.
Core principle: every MCP tool handler is a public API endpoint reached by an unusual (AI) client. All tool descriptions, parameter descriptions, resources, prompts, and tool results are potentially hostile input.
Deliverables
- Attack Surface Map (
../../templates/attack-surface-map.md) - Tool Inventory
- Tool Risk Matrix (
../../templates/tool-risk-matrix.md) - Top Exploit Hypotheses
- Safe Test Plan (
safe-test-plan.md) - Confirmed Findings / Suspected Findings / Non-Issues (Passed Checks)
- Prioritized Fix Plan
- Regression Test Plan
Phases
- Scope & authorization — confirm authorization; prefer staging.
- Inventory — enumerate tools (
tools/list), resources, prompts; note transport and auth requirements. - Attack surface map — external inputs, trust boundaries, sinks.
- Transport exposure — is the endpoint public? TLS? unauthenticated
tools/list/tools/call? CORS? See../../playbooks/mcp-transport-security.md. - AuthN/AuthZ — token validation + per-tool authorization (see
../../playbooks/mcp-auth-authz.md). - Tool metadata review — descriptions/params for poisoning/injection (see
../../playbooks/mcp-metadata-poisoning.md). - Sink classification — for each handler tag sinks: file, shell, DB, HTTP (SSRF), template, deserialization, regex. Fill the Tool Risk Matrix.
- Per-tool abuse testing — run the safe test plan against each tool.
- Resources / prompts review — malicious resource/result/prompt content.
- Agent-specific abuse paths — hand suspicious flows to
agent-abuse-pentest. - Findings — confirmed vs suspected.
- Fix plan — prioritized remediation.
- Regression tests — lock in every fix and deny-by-default expectation.
What to specifically check (attack catalog summary)
See attack-catalog.md for the full list. Highlights:
- unauthenticated
tools/list/tools/call; public endpoint exposure; - weak/missing auth; wrong audience/issuer/scope token accepted;
- cross-user/cross-tenant object access; replay;
- oversized payloads; malformed JSON-RPC; schema bypass; extra params; null/type confusion;
- path traversal; arbitrary file read/write; symlink escape;
- command/argument injection; SQL/NoSQL injection;
- SSRF; internal network / localhost / cloud-metadata access; unsafe redirects;
- unsafe deserialization; template injection; regex DoS; resource exhaustion;
- tool poisoning; malicious metadata/resource/tool-result content;
- destructive tool calls without confirmation; missing audit logs; missing per-tool authorization.
Severity
Use severity-rubric.md.
Report
Use report-template.md, or hand notes to security-report-writer.