MCP Server Attack Probe

Authorized self-test for MCP servers (@modelcontextprotocol/sdk Node, mcp Python). Follow shared probing conventions — discover transport via server.connect(...) in source, env (MCP_PORT, MCP_HOST), or Dockerfile EXPOSE. Stdio servers are tested by spawning the entrypoint binary and exchanging JSON-RPC over stdio.

MCP-specific attack surface

• Tools execute on the server with the server process's privileges, but their arguments are LLM-chosen — i.e., effectively user-controllable through chat.
• Stdio transport is in-process for the spawning client and inherits its privileges (usually OK).
• HTTP / SSE / Streamable HTTP transports turn the server into a network service; if it binds non-loopback or omits auth, any process / browser tab can call tools.
• DNS rebinding: a victim browser visiting attacker.test where DNS rebinds to 127.0.0.1 can call a localhost MCP HTTP server unless Origin is validated.
• Resource URIs (file://, custom schemes) often resolve paths without containment.
• Output size isn't capped by the protocol — flooding the context is a cheap DoS / cost amplification.

Procedure

1. Authorization preflight + transport/port discovery from source.
2. Connect via the appropriate transport.
3. Call tools/list and resources/list to enumerate.
4. Probe per the rule table.