# MCP Server Pentest

> Authorized security assessment of MCP servers and their tool handlers. Treats every tool handler as a public API endpoint with an unusual AI client. Covers transport exposure, authN/authZ, tool metadata review, sink classification, per-tool abuse testing, resources/prompts, and agent-specific abuse paths. Safe-by-default, read-only, deny-by-default. Use when reviewing MCP server code and its tool handlers.

- Skill: `rwcod/mcp-server-pentest` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add rwcod/mcp-server-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rwcod/mcp-server-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: rwcod (https://skillmd.com/u/rwcod)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rwcod/mcp-server-pentest

---


# MCP Server / Tool Pentest

Authorized testing of MCP servers and tool handlers. Read
[../../SECURITY_RULES.md](../../SECURITY_RULES.md) first.

Core principle: **every MCP tool handler is a public API endpoint reached by an
unusual (AI) client.** All tool descriptions, parameter descriptions, resources,
prompts, and tool results are **potentially hostile input**.

## Deliverables
- Attack Surface Map (`../../templates/attack-surface-map.md`)
- Tool Inventory
- Tool Risk Matrix (`../../templates/tool-risk-matrix.md`)
- Top Exploit Hypotheses
- Safe Test Plan (`safe-test-plan.md`)
- Confirmed Findings / Suspected Findings / Non-Issues (Passed Checks)
- Prioritized Fix Plan
- Regression Test Plan

## Phases

1. **Scope & authorization** — confirm authorization; prefer staging.
2. **Inventory** — enumerate tools (`tools/list`), resources, prompts; note
   transport and auth requirements.
3. **Attack surface map** — external inputs, trust boundaries, sinks.
4. **Transport exposure** — is the endpoint public? TLS? unauthenticated
   `tools/list`/`tools/call`? CORS? See `../../playbooks/mcp-transport-security.md`.
5. **AuthN/AuthZ** — token validation + per-tool authorization (see
   `../../playbooks/mcp-auth-authz.md`).
6. **Tool metadata review** — descriptions/params for poisoning/injection (see
   `../../playbooks/mcp-metadata-poisoning.md`).
7. **Sink classification** — for each handler tag sinks: file, shell, DB, HTTP
   (SSRF), template, deserialization, regex. Fill the Tool Risk Matrix.
8. **Per-tool abuse testing** — run the safe test plan against each tool.
9. **Resources / prompts review** — malicious resource/result/prompt content.
10. **Agent-specific abuse paths** — hand suspicious flows to `agent-abuse-pentest`.
11. **Findings** — confirmed vs suspected.
12. **Fix plan** — prioritized remediation.
13. **Regression tests** — lock in every fix and deny-by-default expectation.

## What to specifically check (attack catalog summary)
See `attack-catalog.md` for the full list. Highlights:
- unauthenticated `tools/list` / `tools/call`; public endpoint exposure;
- weak/missing auth; wrong audience/issuer/scope token accepted;
- cross-user/cross-tenant object access; replay;
- oversized payloads; malformed JSON-RPC; schema bypass; extra params;
  null/type confusion;
- path traversal; arbitrary file read/write; symlink escape;
- command/argument injection; SQL/NoSQL injection;
- SSRF; internal network / localhost / cloud-metadata access; unsafe redirects;
- unsafe deserialization; template injection; regex DoS; resource exhaustion;
- tool poisoning; malicious metadata/resource/tool-result content;
- destructive tool calls without confirmation; missing audit logs; missing
  per-tool authorization.

## Severity
Use `severity-rubric.md`.

## Report
Use `report-template.md`, or hand notes to `security-report-writer`.