hunt-mcp-security

name	hunt-mcp-security
description	Hunt Model Context Protocol (MCP) vulnerabilities in AI-tool integration systems.
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3
tags	["redteam","MCP","AI","tool-security","agent","prompt-injection","OWASP"]
category	redteam
related_skills	["hunt-llm-ai","hunt-api-misconfig","hunt-auth-bypass"]

MCP Security Hunting

Hunt vulnerabilities in Model Context Protocol (MCP) implementations — the standard protocol that lets AI applications connect to external tools (databases, APIs, files, web services). MCP introduces a unique attack surface where AI agents become the attack vector and tool responses become the delivery mechanism. Tools exposed without access control, unsanitized input handling, and over-trusted tool outputs enable privilege escalation, data exfiltration, and system compromise through the AI itself.

When to Use

• Target deploys AI agents with MCP tool access (Claude Desktop MCP, Cursor AI tools, custom agent frameworks).
• AI agent can invoke tools (database queries, file operations, API calls, web searches).
• Tool registration, schema validation, or access control logic is present.
• Need to test whether tool outputs can inject prompts back into the agent.
• Target uses RAG (Retrieval Augmented Generation) with external data sources.

Quick Detection

# Check if MCP server is exposed on common ports
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/mcp/" -w "%{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/.well-known/mcp" -w "%{http_code}\n" -o /dev/null

# Common MCP tool names in API documentation
grep -r "tool\|mcp\|function_call\|tool_choice" openapi.json

Procedure

Phase 1 — Tool Access Control (MCP01, MCP08)

# Check if tools accept unauthenticated requests
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/mcp/tools/execute" \
  -H "Content-Type: application/json" \
  -d '{"tool":"delete_all_users","args":{}}'

# Enumerate availabletools via schema
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/mcp/tools" | jq '.tools[].name'
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/mcp/schema" | jq '.functions'

# Test if any user can invoke admintools
for tool in "delete_users"    \
              ; 
  curl --max-time 30 --connect-timeout 10 -sk -X POST  -d  \
    -w  -o /dev/null