About Pentesting MCP Servers Checklist
Pentesting MCP Servers Checklist is an MCP server published by appsecco in the Security category: a practical, community-driven checklist for pentesting MCP servers. Covers traffic analysis, tool-call behavior, namespace abuse, auth flows, and remote server risks. Maintained by Appsecco and licensed for remixing.
The repository has 42 stars and 8 forks, with the last commit 6 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.
Install
git clone https://github.com/appsecco/pentesting-mcp-servers-checklistThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Ask AI
Ask AI about Pentesting MCP Servers Checklist
Powered by Claude · Grounded in docs
Security checks
Static checks derived from the repository 3 hours ago. Heuristics on the source, not an audit.
- ✓README presentThe repository ships documentation.
- ✓License declaredUsable under a stated license.
- !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
- !Dependencies pinnedNo lockfile. Installs can pull different code over time.
- !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.
1 check has not been run yet.
Releases
README
README
Version 3 is out now!
A practical, community-driven checklist for pentesting Model Context Protocol (MCP) servers. This guide covers local and remote MCP server risks, traffic analysis, tool-call behaviors, context boundaries, authorization flows, and unsafe code paths.
Originally created for the OWASP Bay Area talk on Pentesting MCP Servers (Oct 2025), this checklist is designed for practitioners performing assessments on MCP-based tools, agents, and integrations.
Why this exists
MCP servers are becoming the new execution layer for AI agents. This means they expose:
- File system access
- Tool execution
- Remote APIs
- STDIO and HTTP bridges
- Autonomous actions initiated by LLMs
Because of this, MCP servers introduce a wide attack surface that security testers need structured guidance for. This checklist helps you perform systematic and repeatable assessments.
What this checklist covers
- Traffic Analysis — proxy inspection of STDIO/HTTP, context injection, TLS enforcement
- Authentication & Authorization — auth bypass, OAuth flows, IDOR, privilege escalation
- Local MCP Server File and Code Review — embedded secrets, dangerous functions, dependency audits
- MCP Tool Behavior and Functionality — tool boundary validation, chaining, local RCE
- Tool Security — Input Validation — command injection, path traversal, SSRF, SQLi, SSTI
- Tool Security — Output & Schema Validation — schema mismatches, sensitive data leakage, prompt injection via output
- Tool Injection — prompt injection via tool names/descriptions, tool shadowing, name collisions
- File System & Network Access — path traversal, scope enforcement, DNS rebinding
- Context Isolation — cross-user leakage, namespace separation, session persistence
- Secret & Credential Handling — hardcoded secrets, log exposure, token caching
- Logging & Monitoring — log injection, rate limiting, access controls
- Race Conditions & Concurrency — TOCTOU, parallel invocation, resource exhaustion
- Advanced Attacks — context pollution, confused deputy, prototype pollution, GraphQL injection
How to use this repo
- Use the CHECKLIST.md for field assessments
- Fork and adapt it for your team
- Submit PRs with improvements
- Open issues for new MCP attack patterns
Contribute
We welcome:
- New checklist items
- Additional MCP server categories
- Tooling contributions
- Red-team test cases
- Sanitized findings
License
This project is licensed under CC BY 4.0. You may remix, adapt, and build upon this checklist for any purpose, even commercially, as long as you provide attribution.
Maintainers
Appsecco
README fetched from the repository 3 hours ago. The original is authoritative.