Hunt Agent MCP Exposure

MCP is the standard agent↔tools/resources interface. When the MCP endpoint is reachable by a client you control, you bypass the agent's guardrails and read protected resources directly. Enterprises increasingly stand up shared MCP tool servers — often with the MCP session separate from (and weaker than) the app's user auth.

Where This Lives / Attack Surface Signals

• Agent says "connection severed / interface down" but names an endpoint.
• Headers carry mcp-session-id; app opens SSE/EventSource.
• Tools named unlock_*/authorize_*/enable_* → likely feature gates, not boundaries.
• structured_content, jsonrpc, resource:// in traffic.
• Multi-agent → each agent may have its own MCP endpoint/resources.
• MCP proxy fronting a third-party API (OAuth flow present): WWW-Authenticate challenge, authorization_servers/resource_metadata URLs, dynamic client registration, a static client_id to the upstream, a consent cookie. → delegated-identity surface (Technique below).

Crown Jewel Targets

Shared MCP servers backing multiple tenants/agents → protected resources (secrets, customer data), privileged tools (exec/write/deploy). MCP session ≠ web session = the common access-control gap.

Characterize First

1. Locate endpoint: ask the agent, read errors, watch SSE/mcp-session-id, probe /mcp /api/mcp /v1/mcp /sse /events, grep JS. Transport: Streamable HTTP (POST+mcp-session-id) vs legacy SSE (GET→POST URL).
2. Auth model: is the MCP session the web session or separate? Cookie auth may not gate MCP.
3. Protocol version: negotiate one the server accepts (check JS if 2024-11-05 rejected). Don't hardcode.