Mcp server security scan

MCP Server Security Scan

Defensive scan for MCP servers (@modelcontextprotocol/sdk Node, mcp Python). Reports findings using the shared scoring schema.

Scope

• Files importing @modelcontextprotocol/sdk/* or mcp (Python)
• Tool / resource / prompt registrations (server.tool, @server.list_tools, etc.)
• Transport setup (StdioServerTransport, SSEServerTransport, StreamableHTTPServerTransport)

Threat model recap

MCP tools execute on the server's trust boundary but are invoked at the LLM's discretion based on a user's conversation. Treat tool arguments as fully attacker-controlled: a user can craft chat input or upload a document that causes the model to call your tool with adversarial arguments (indirect prompt injection).

Rules

ID	Severity	Detection	Fix
MCP-FS-001	critical	Tool accepts path / filename argument and reads/writes the filesystem with no containment check (no path.resolve + startsWith(BASE))	Resolve under a fixed base dir; reject if outside
MCP-FS-002	high	Tool uses fs.readFile/fs.writeFile on a user-supplied path with no allowlist of base directories	Configure allowlist via env; refuse otherwise
MCP-EXEC-001	critical	Tool runs child_process.exec / subprocess.run(shell=True) with command built from arguments	Use spawn with arg array; allowlist commands; reject metacharacters
MCP-NET-001	high	Tool performs HTTP fetch with arbitrary user URL (SSRF: localhost, RFC1918, link-local, AWS metadata 169.254.169.254)	Resolve hostname; block private/link-local/loopback; allowlist if possible
MCP-AUTH-001	critical	HTTP/SSE transport bound to non-loopback interface without authentication middleware (any process on the network can call tools)	Require bearer token / mTLS; bind to loopback unless intentional
MCP-AUTH-002	high	Streamable HTTP transport without Origin/Host validation (DNS rebinding from a victim's browser to localhost MCP)	Validate Origin; require non-browser auth header
MCP-VALID-001	high	Tool registered without input schema (inputSchema / zod / Pydantic)	Define and enforce schema; reject unknown fields
MCP-VALID-002	medium	Tool schema uses additionalProperties: true or z.any() / Dict[str, Any] for arguments	Tighten schema
MCP-RES-001	high	Resource URI scheme allows arbitrary paths (file:///{anything}) without containment	Resolve under a base dir; refuse parent traversal
MCP-RES-002	medium	Resource list includes secrets (.env, key files, ~/.aws)	Apply ignore list comparable to a .gitignore-style filter
MCP-OUT-001	medium	Tool returns unbounded output (full file, full table) that can flood the model's context window — DoS / cost amplification	Cap output size; truncate with explicit notice
MCP-OUT-002	high	Tool output forwards untrusted content (e.g., webpage fetched by tool) without marking provenance	Tag output with source/trust metadata so the calling agent can apply data-vs-instruction framing
MCP-LOG-001	medium	Tool arguments / results logged to disk or remote sink without redaction	Log tool name and run id; redact bodies
MCP-PROMPT-001	medium	Server-defined prompts include literal credentials or per-tenant data	Parameterize via prompt arguments; never bake secrets in
MCP-VER-001	low	Server advertises capabilities it does not implement (e.g., declares tools but registers none)	Match advertised capabilities to implementation

Wrong vs. right

MCP-FS-001 (path traversal)

// ❌ ../../etc/passwd
server.tool('read_doc', { path: z.string() }, async ({ path }) => {
  const text = await fs.readFile(path, 'utf8');
  return { content: [{ type: 'text', text }] };
});

// ✅ Containment + allowlist
const BASE = path.resolve(process.env.MCP_DOC_ROOT!);
server.tool(
  'read_doc',
  { path: z.string() },
  async ({ path: rel }) => {
    const target = path.resolve(BASE, rel);
    if (!target.startsWith(BASE + path.sep)) throw new Error('forbidden');
    const text = await fs.readFile(target, 'utf8');
    return { content: [{ type: 'text', text }] };
  },
);

MCP-AUTH-001 (HTTP transport without auth)

// ❌ Network-reachable, no auth
const transport = new StreamableHTTPServerTransport({ port: 8080 });
await server.connect(transport);

// ✅ Auth + Origin check + loopback default
const transport = new StreamableHTTPServerTransport({
  host: '127.0.0.1',
  port: 8080,
  requestHook: (req) => {
    if (req.headers.authorization !== `Bearer ${process.env.MCP_TOKEN}`) {
      throw new Error('unauthorized');
    }
    const origin = req.headers.origin;
    if (origin && !ALLOWED_ORIGINS.has(origin)) throw new Error('bad origin');
  },
});

MCP-NET-001 (SSRF)

# ❌ Tool fetches anything
@server.tool()
async def fetch(url: str) -> str:
    async with httpx.AsyncClient() as c:
        return (await c.get(url)).text

# ✅ DNS resolved + private-range blocked
import ipaddress, socket

BLOCKED = [ipaddress.ip_network(n) for n in
    ("127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
     "169.254.0.0/16", "::1/128", "fc00::/7", "fe80::/10")]

def safe_host(host: str) -> bool:
    for _, _, _, _, sa in socket.getaddrinfo(host, None):
        ip = ipaddress.ip_address(sa[0])
        if any(ip in n for n in BLOCKED):
            return False
    return True

@server.tool()
async def fetch(url: str) -> str:
    parsed = urlparse(url)
    if parsed.scheme not in ("http", "https") or not safe_host(parsed.hostname):
        raise ValueError("forbidden")
    ...

References

• MCP specification: https://modelcontextprotocol.io/specification
• MCP TypeScript SDK: https://github.com/modelcontextprotocol/typescript-sdk
• MCP Python SDK: https://github.com/modelcontextprotocol/python-sdk
• OWASP SSRF: https://owasp.org/www-community/attacks/Server_Side_Request_Forgery