Learning objectives

Learn how the MCP attack surface can be probed via tool schema security and input validation, and how to test and defend against it.

Audience

Red teamers assessing Model Context Protocol implementations
Security testers validating MCP servers, hosts, and transports

Prerequisites

Basic idea of MCP: Client, Host (bridge), and Server topology; JSON-RPC 2.0 transport; tools and resources as attack vectors.

What this experiment demonstrates

Whether tool definitions returned by tools/list use strict input schemas (types, enums, min/max length) or leave parameters as free-form strings. Loose schemas allow the LLM (or an attacker) to pass unexpected values that may trigger injection or privilege escalation downstream.

Why it matters

MCP exposes resources and tools to LLMs; lifecycle, trust boundaries, transport, and tool arguments are critical to secure design.

How it works

Call tools/list and collect the list of tools and their inputSchema (JSON Schema) for each tool.
For each tool, check whether parameters are typed (e.g. type: "string" with minLength/maxLength), allow additional properties, or use broad patterns that accept paths or raw input.
Flag tools that accept unbounded strings for file paths, URIs, or "query"-style arguments as higher risk for path traversal, SSRF, or injection.
Use the schema to design follow-up tests: e.g. pass values that violate the schema and see if the server rejects them or forwards them to the backend.

// Example: tools/call with an extra, undefined argument (test if server forwards it)
{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{
  "name":"read_file",
  "arguments":{"path":"/allowed.txt","__proto__":{}}
}}

What success looks like

Secure behavior: errors or rejections as expected. Vulnerable behavior: unauthorized access, reflected injection, command execution, or information disclosure.

Key concepts

MCP topology: init before operational requests
Trust boundaries: output sanitization, host authorization, user intent
Transport: deserialization, DoS, error disclosure
Tools and resources: injection, SSRF, schema security

Red team takeaway

Probe lifecycle enforcement, handshake fuzzing, tool schemas, reflected output, path traversal, argument coercion, parameter overflow, request flooding, error leakage, credential and token exposure, message correlation, UI spoofing, invisible payloads, scope escalation, protocol downgrade, URI schemes, and command injection.

Defensive considerations

Enforce init before tools/resources; validate and sanitize tool output and arguments; enforce path and URI allowlists; cap payload size and request rate; sanitize error messages; protect credentials and tokens in transit; validate scope for resources.

Related experiments

Other A01 experiments: Lifecycle Enforcement, Reflected Injection, Path Traversal, Parameter Overflow, URI Scheme Fuzzing, Encapsulated Command Injection.