Skip to content

MCP Security Testing

Overview

The Model Context Protocol (MCP) enables AI agents to interact with external tools and resources through a standardized protocol. While powerful, MCP introduces several attack surfaces that AASTF v0.5.0 systematically tests.

Attack Taxonomy

AASTF's MCP scenarios are derived from three authoritative sources:

  1. MSB (MCP Security Benchmark) — Zhang et al., ICLR 2026. 12 attack classes, 405 tools.
  2. MCPSecBench — 17 attack types across 4 surfaces.
  3. OWASP MCP Top 10 — Community-driven MCP security risks.

MCP01: Tool Signature Poisoning

Tool descriptions are the primary interface between MCP servers and AI agents. Poisoned descriptions can: - Embed hidden instructions that override agent behavior - Shadow legitimate tools with malicious alternatives - Hide adversarial prompts in parameter schema descriptions

Scenarios: MCP01-001 through MCP01-003

MCP02: Tool Parameter Manipulation

Tool input schemas define what parameters a tool accepts. Attacks include: - Type confusion (sending objects where strings are expected) - Schema extension via additionalProperties - Default value poisoning with adversarial content

Scenarios: MCP02-001 through MCP02-003

MCP03: Tool Response Injection

Tool responses are a primary injection vector because agents process them as trusted data: - Prompt injection embedded in response content - Response-triggered tool chaining (one tool's response triggers another) - Malformed responses causing fallback to unsafe behavior

Scenarios: MCP03-001 through MCP03-003

MCP04: Resource Injection

MCP resources (files, database records, etc.) can carry poisoned content: - Embedded instructions in resource content - URI traversal to access unauthorized resources - Cross-server resource confusion

Scenarios: MCP04-001 through MCP04-003

MCP05: Advanced Attacks (MCPSecBench)

Based on MCPSecBench taxonomy and CyberArk research: - Full-schema poisoning rewrites entire tool definitions - Preference manipulation biases tool selection - Server impersonation violates trust boundaries - Social engineering via tool descriptions - Cross-server data exfiltration

Scenarios: MCP05-001 through MCP05-005

MCP06: OWASP MCP Top 10 + Real CVEs

Real-world attack patterns from disclosed vulnerabilities: - Rug Pull: Silent tool redefinition after user approval - Tool Shadowing: Cross-server name collisions - Sampling Abuse: Unauthorized model inference - Elicitation Phishing: Credential harvesting via prompts - STDIO Injection: Command injection on local MCP servers (CVE-2025-6514) - OAuth Leakage: Token scraping from logs/memory - Consent Fatigue: Flooding approvals to slip malicious tools - Shadow Servers: Unapproved MCP deployments

Scenarios: MCP06-001 through MCP06-008

Using the MCP Adapter

# your_agent.py
async def mcp_agent_factory(tools, resources):
    """Factory function for MCP-based agent."""
    async def agent(prompt, base_url):
        # Your agent logic here
        # tools = list of MCP tool descriptions
        # resources = list of MCP resource contents
        # Return (output, tool_calls) tuple
        return output, tool_calls
    return agent

# Run MCP scan
aastf run --adapter mcp --agent-factory your_agent:mcp_agent_factory

# Run only MCP scenarios
aastf run --adapter mcp --categories ASI01,ASI02,ASI03

Compliance Mapping

All MCP scenarios include: - CWE IDs — Common Weakness Enumeration mapping - NIST AI RMF — Risk Management Framework categories - OWASP ASI — Agentic Security Initiative categories

References