mcp-witness

Coordinated-disclosure track for Model Context Protocol server security — and the scanner that finds the filings.

Six coordinated security disclosures against PyPI-published MCP servers

One vendor-declined outcome (community fix PR unmerged, disclosure closed as "not planned"). One maintainer-confirmed-unmaintained outcome. Four silent through embargo, no fix. All six embargoes expired 2026-08-10; all publicly disclosed; CVE requests filed for all six (2026-09-11).

mcp-witness is built around the disclosure track at disclosures/. The scanner — 14 static rules + 7 dynamic scenarios + a capability classifier — is the engine that surfaces filings. The disclosure records and their outcomes are the durable artifacts:

• mcp-server-fetch v2025.4.7 — SSRF demonstrated on EC2 with real AWS IAM credentials retrieved (AccessKeyId / SecretAccessKey / Token triplet). Coordinated disclosure filed as modelcontextprotocol/servers#4143 on 2026-05-12. Community contributor @kgarg2468 opened fix PR #4226 on 2026-05-22 (scheme allowlist + RFC-reserved-range denylist + per-redirect validation); CI green (16/16), external technical audit by @LuuOW, branch verified end-to-end via containerized poc/ssrf/ harness against the link-local IMDS vector. 🔴 Disclosure closed as "not planned" by Anthropic contributor @localden (2026-07-30) and consolidated to dormant umbrella issue #3741 (opened 2026-03-27, no substantive activity since). PR #4226 remains open + unmerged despite CI green + external review + independent reproduction. Three releases shipped since disclosure (v2026.6.4, v2026.7.10, v2026.8.18); current latest v2026.8.18 (2026-08-18) still vulnerable, runtime-verified via the poc/ssrf/ harness on 2026-09-10. Coordinated-disclosure obligations satisfied; 2026-08-10 embargo observed.
• mcp-server-http-request v0.1.0 (statespace) — same SSRF class. Filed via email 2026-05-12, silent through day +30, then maintainer-confirmed unmaintained via LinkedIn DM on 2026-06-11 ("not an actively maintained package"). Yank request pending.
• 4× DNS rebinding in HTTP-transport servers — mcp-streamablehttp-proxy, mcp-fetch-streamablehttp-server, fastmcp-http, mcp-server-fetch-sse. All disclosed; embargo expired 2026-08-10; all four silent-with-no-fix and still vulnerable (verified 2026-09-10). Reproducible end-to-end via the containerized harness at poc/dns-rebind/ (make demo).

Two CVE-track vulnerability classes covering both ends of the MCP transport boundary — server reaching out (SSRF), browser reaching in (DNS rebind). The detectors that found them are static rules MCP-S-009 (SSRF) + MCP-S-014 v0.3 (DNS rebind, four-patch W1–W4 series developed from the survey itself) + dynamic scenario MCP-D-003 (SSRF). Detector evolution is itself part of the audit trail — every patch is documented against the finding that motivated it.

Full disclosure track: disclosures/ — status table, methodology notes, channel-decision audit trails. Per-finding evidence: findings/ — reproduction + raw output + interpretation, one file per observation.

Published writeups

The full start-to-finish account of each CVE-track class, written up after the embargo:

• I found an SSRF in Anthropic's reference MCP server, proved it on EC2, and the verified fix is still unmerged — the outbound SSRF class in mcp-server-fetch, proven with live IAM credentials, the community fix verified twice, and the four-month unmerged ending.
• One assumption, four packages: inbound DNS rebinding across HTTP-transport MCP servers — the inbound DNS-rebinding class across four independently authored servers, framed as one architectural assumption held four times.

Findings ledger

Twelve documented audit observations against eleven PyPI-published servers, captured in findings/ (status-table index at findings/README.md), plus a DNS-rebinding class survey that frames four of them as one class:

Each entry includes reproduction commands, the raw trace, an interpretation, caveats, and a disclosure recommendation. Two CVE-track classes, all six now public with CVE requests filed (2026-09-11): SSRF in stdio fetch servers (2 packages; 1 vendor-declined with a branch-verified fix left unmerged, 1 maintainer-confirmed unmaintained) and DNS rebinding in HTTP-transport servers (4 packages, all silent-with-no-fix).

Quickstart — audit any pip-installable MCP server in one command

pip install mcp-witness
mcp-witness-audit mcp-server-fetch

That single command pip-installs mcp-server-fetch (or any other PyPI MCP server), captures its tools/list over stdio, runs the static analyzer rules, runs the capability classifier, and prints a human-readable report. Sample output against the official Anthropic reference server:

=== mcp-server-fetch ===
Launched: /usr/bin/python3 -m mcp_server_fetch
Tools:    1
  fetch
Capability tags: net_egress

2 analyzer findings:
  [HIGH    ] MCP-S-001  fetch
      Tool description contains instruction-like phrasing directed at the model.
  [HIGH    ] MCP-S-009  fetch
      Tool has URL parameter(s) ['url'] with no schema-level constraint
      and no validation keywords in the description.

Capture saved to: calibration/reports/captured-mcp-server-fetch.json

Two real findings on the official Anthropic reference server, surfaced from one mcp-witness-audit command — one at the description level (S-001 catches agent-directed instructions in the tool's docstring), one at the schema level (S-009 catches the missing SSRF allowlist). The SSRF one was demonstrated end-to-end on EC2 with real IAM credentials retrieved, disclosed via #4143, and fixed by PR #4226 (verified).

What's inside

CLIs

Static analyzer rules (14 of 14 v0.1 rules implemented)

Every rule's lexicon decisions are commented with the calibration evidence that drove them. Spec for all 14 rules: docs/static-rules.md.

Dynamic scenarios (7 in the seed set)

Scenario YAML format: docs/scenario-schema.md. The seed set lives in scenarios/ and is described in scenarios/README.md. Highlights:

• MCP-D-002 — path traversal in filesystem-read tools (direct probe, no LLM needed)
• MCP-D-003 — SSRF in URL-fetching tools (direct probe; produces the cloud-metadata finding)
• MCP-D-001 / MCP-D-006 — tool-description injection at two phrasing tiers (obvious vs subtle)
• MCP-D-004 — tool-definition rug pull (mutate after first approval)
• MCP-D-005 — invisible Unicode-tag-character injection via tool output
• MCP-D-007 — cloud metadata-service exfiltration via URL-fetcher (strict oracle — only fires on actual metadata response content, designed for EC2/GCP/Azure audit verification)

Capability classifier

Layer 1 (lexical) classifier shared by analyzer rules and harness scenario filtering. 8 capability tags, 8 parameter roles, three-tier confidence (high / medium / low). Per the spec, promotion to "stable" requires ≥10-target corpus + ≥90% precision on high-confidence outputs.

Current calibration corpus state: 11 labeled targets, 87 tools, 100% precision and 100% recall on all six exercised capability tags (db_query, db_write, exec, fs_read, fs_write, net_egress). Verified by direct capture against 8 of 11 targets. Hit the spec's ≥10-target / ≥0.9-precision / ≥0.75-recall "stable" threshold. CI-protected against regression: calibration/tests/test_corpus_regression.py runs the full eval on every PR and fails if precision drops below 0.90, recall below 0.75, target count below 10, parameter-role accuracy below 0.80, or any of the original four v0.1 tags disappears from the corpus. See calibration/README.md.

Dynamic harness

Two modes auto-selected per scenario:

• Direct mode — agent-less, harness as MCP client. Used for server-side validation tests (path traversal, SSRF).
• Proxy mode — harness mediates between an agent under test and the real target, applying mutations to tool descriptions and outputs in flight. Used for agent-side scenarios (description injection, rug pull, output injection).

Two agent driver implementations: stub (deterministic, plumbing tests) and anthropic (real Claude tool-use loop). See harness/README.md.

Detections (defender signatures)

The offensive half of this repo shows how MCP servers break; detections/ is the other half. Each disclosed class is paired with defender signatures anchored to a finding that was proven end to end, not to a hypothesis:

• Sigma rules (portable, convert with pySigma) for the SSRF-to-metadata, SSRF-to-internal, DNS-rebind-answer, and inbound Origin/Host-mismatch signatures, each carrying CWE + MITRE ATT&CK tags.
• Suricata network signatures (SIDs 9000001+) for the same classes.
• A self-contained validator (mcp-witness-detect) that runs every rule against attack and benign fixtures and fails on a single miss or false positive, plus make validate-live which runs the real poc/ probes and matches their actual output. See detections/README.md.

Runtime guardrail (detect and prevent)

Detections catch attacks after the fact; the guardrail/ proxy enforces the same policy live. Point your MCP client at mcp-witness-guardrail -- <server command> and it sits between client and server on the stdio JSON-RPC stream:

• SSRF egress block — a tools/call whose URL argument resolves to a reserved address (link-local IMDS, RFC1918, loopback) is refused with a JSON-RPC error before it reaches the server, so the credential fetch never happens. Hostnames are resolved first, catching metadata.google.internal and rebind flips.
• Tool rug-pull block — each tool definition is pinned on first sight; if a later tools/list changes it (the MCP-D-004 mutate-after-approval vector), the tool is flagged and calls to it are refused.

Decisions are emitted in the detections event schema, so blocking at runtime and detecting in the SIEM share one shape. block and monitor modes; the whole decision path is unit-tested and an end-to-end test proves an SSRF call is stopped before a real server subprocess can leak. See guardrail/README.md.

Fuzzer (find new bugs)

Where the analyzer reads a tool definition statically, the fuzzer/ drives a locally-run server with adversarial inputs at scale. mcp-witness-fuzz -- <server command> captures tools/list, then uses the classifier to aim payloads by parameter role:

• SSRF payloads at url/host params, traversal at path, injection at command/query, plus type-confusion, boundary (empty / 100k / control bytes / unicode), and protocol malformations for every tool.
• An oracle classifies each response: crash, hang, sensitive-read, ssrf-hit, command-injection, error-leak, sql-error, or a clean rejected (not a finding). Findings are deduplicated and severity-ranked.

Fuzz servers you run yourself, disclose responsibly, and confirm each finding manually before it becomes a report or CVE request. The payloads, oracle, and engine are unit-tested against an in-process vulnerable server that exhibits every bug class, with a well-behaved tool proving no false positives. See fuzzer/README.md.

Architecture

mcp-witness/
  analyzer/      Static analysis: Python AST + captured-JSON modes, 14 rules
  classifier/    Capability tagger: 8 tags, 8 param roles, Layer 1 (lexical)
  harness/       Dynamic test runner: direct + proxy modes, stub + Claude agents
  scenarios/     Attack-scenario YAML library (7 scenarios)
  calibration/   Ground-truth corpus + eval driver + capture/scaffold tools
  findings/      Audit-trail record (12 entries + 1 class survey; append-only)
  disclosures/   Append-only log of outgoing coordinated-disclosure communications
  docs/          Specs: rules, scenarios, classifier, threat model

Roadmap and current state

Scope and non-goals

In scope for v1:

• Static and dynamic vuln discovery in MCP server implementations
• Agent-level attack scenarios against spec-conformant servers
• Python servers (analyzer); any-language servers via captured tools/list JSON
• stdio transport (harness)
• MCP spec version 2025-06-18

Not yet implemented (planned):

• TypeScript analyzer support (tree-sitter; would unlock 5 queued TS calibration targets)
• SSE / Streamable HTTP transports in the harness
• DNS / filesystem canaries (HTTP only today)

Out of scope for v1 (intentional — these are good follow-ups, not features):

• Runtime "agent firewall" / behavioral detection / EDR-for-agents
• Non-MCP agent frameworks (LangChain, AutoGPT, custom orchestrators)
• Production WAF-style protection
• Host-side hardening recommendations beyond what the scanner emits

Project metrics

Running the test suite

pip install -e ".[dev]"
pytest

With coverage:

pytest --cov=analyzer --cov=classifier --cov=harness --cov=calibration --cov-report=term-missing

Lint + format:

ruff check .
ruff format --check .

Optional pre-commit hooks (one-time setup):

pip install pre-commit
pre-commit install

After install, every git commit runs ruff + a fast tests subset on push.

For dynamic scenarios that exercise a real LLM, install the optional Anthropic agent and set an API key:

pip install "mcp-witness[anthropic]"
export ANTHROPIC_API_KEY=sk-ant-...
mcp-witness-test scenarios/MCP-D-001-tool-desc-injection-fetch.yaml \
    --server-cmd python --server-arg=-m --server-arg=mcp_server_fetch \
    --agent anthropic

Methodology and threat model

Attack surface enumerated by MCP primitive (tools, resources, prompts, sampling, roots) plus transport and cross-cutting agent-level attacks. Every detection rule and every scenario carries a category field mapped back to this taxonomy. The categories and tag/role vocabularies live in:

• docs/static-rules.md — detection rules and lexicon decisions
• docs/scenario-schema.md — dynamic scenario YAML schema and step types
• docs/capability-classifier.md — capability tag and parameter role vocabularies, calibration plan
• docs/detector-evolution-s014.md — worked example of how MCP-S-014 went from one of five to four of four across the W1–W4 patch series; methodology notes for static-rule evolution
• docs/methodology-soft-escalation.md — the LinkedIn escape valve pattern: how a polite "if this is unmaintained, that's fine, just let me know" surfaced a verified maintainer reply on day +30 after 30 days of email silence

Responsible disclosure

Findings against third-party servers follow coordinated disclosure: maintainers receive 90 days from notification before public release, extended if a fix is in active development. Reporters using mcp-witness are expected to follow the same practice. The disclosures/ directory documents every outgoing coordinated-disclosure communication, including channel-decision audit trails — when a public issue was the channel of last resort (ARadRareness/mcp-registry#3), when an intake automation deflected (HackerOne triage interstitial + disclosure@anthropic.com auto-responder, both documented as substantive disclosure outcomes), when a LinkedIn DM with a polite escape-valve surfaced an unmaintained-confirmation after 30 days of email silence.

The disclosure track is the project's load-bearing artifact. See disclosures/README.md for the full status table and methodology notes.

Policy + contact: SECURITY.md.

Contributing

Issue discussion and ruleset/scenario proposals are welcome. Highest-leverage places to contribute right now:

1. Label more calibration targets. The corpus needs more labeled servers for the classifier to grow beyond the current stable threshold. The workflow is press-button (capture → scaffold-gt → hand-label → eval-calibration). See calibration/README.md.
2. Propose new analyzer rules following docs/static-rules.md §Rule lifecycle. Real-world evidence (from a captured server) is the bar for inclusion.
3. Propose new dynamic scenarios following docs/scenario-schema.md. Same evidence bar.

License

Apache 2.0 — see LICENSE.