Add Model Context Protocol (MCP) server unauthenticated tools/list detector

Template Request

Template gap: no existing template detects Model Context Protocol (MCP) servers exposing the JSON-RPC 2.0 tools/list method without any authentication. This is now a high-impact, industry-wide misconfiguration class with published CVEs and a documented population of thousands of exposed servers.

What is MCP?

Model Context Protocol (MCP) is the open protocol used by AI agents (Claude, ChatGPT, Cursor, Windsurf, custom LangChain / LangGraph agents, etc.) to invoke external tools. Every tool an MCP server exposes is discovered via tools/list and invoked via tools/call, both plain JSON-RPC 2.0 methods. When the operator forgets or skips authentication, ANY unauthenticated caller can enumerate every tool the server implements and invoke it with arbitrary arguments — the tool set often includes file I/O, shell exec, database queries, cloud-API calls, credential lookups, whatever the operator wired up.

Real-world impact

• CVE-2026-59822: LiteLLM MCP proxy authentication bypass — unauthenticated tools/list + tools/call.
• CVE-2026-59705 / CVE-2026-59706: mem0 unauthenticated API family — same class.
• Public survey (webpro255/awesome-ai-agent-attacks, 2026): of 9,695 exposed MCP servers scanned, 2,054 (~21%) had NO authentication at all. This is a huge live population that nuclei users would want to sweep on any external engagement or internal assessment.

Full detail on the CVE + population source lives in the AI-agent-attacks research corpus at https://github.com/webpro255/awesome-ai-agent-attacks.

Detection design

Four POST paths tried in one template:

• {{BaseURL}}/mcp — common for gateway-style deployments
• {{BaseURL}}/messages — the JSON-RPC-over-HTTP transport variant
• {{BaseURL}}/sse — the SSE transport variant (some implementations accept POST on the same path)
• {{BaseURL}}/ — some minimal implementations mount at root

Body is the literal JSON-RPC 2.0 tools/list request:

{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}

Matchers (all must match a positive real-MCP response):

1. Status 200
2. Body contains the jsonrpc: 2.0 protocol header (positive proof it's speaking JSON-RPC 2.0)
3. Body contains result field (successful RPC response)
4. Body contains tools or inputSchema token (positive proof it's a tools/list response, not an arbitrary JSON API)
5. Body does NOT contain any of error, code:-32, Unauthorized, 401 (negative suppression — auth-required responses are correctly ignored, not flagged)

Extractors surface the enumerated tool names and tool descriptions so operators immediately see which capabilities leaked.

Local validation

Regex battery-tested locally against 4 fixture responses per protocol spec:

• Real MCP tools/list response (with execute_query + read_file tools) → matches, extracts both tool names + descriptions.
• Auth-required MCP response (error.code=-32001, message=Unauthorized) → correctly does NOT match (negative suppression works).
• Arbitrary JSON API response ({status:ok, result:{data:[]}}) — matches only result token, missing tools/inputSchema/jsonrpc → correctly does NOT match (positive requirements filter out non-MCP JSON).
• HTML 404 page → does NOT match.

YAML parses cleanly via yaml.safe_load.

Severity

high / CVSS 9.8 — unauthenticated invocation of arbitrary server-side tools (often including RCE-adjacent primitives like shell exec and file I/O) is CVSS-critical, but many MCP deployments expose only read-only or narrow tools, so high is the calibrated severity floor. CWE-306 (Missing Authentication for Critical Function).

PR

PR: https://github.com/projectdiscovery/nuclei-templates/pull/PLACEHOLDER (opening immediately)

Path: http/misconfiguration/mcp/mcp-server-unauth-tools-list.yaml

References

• https://modelcontextprotocol.io/specification/2025-06-18/server/tools
• https://modelcontextprotocol.io/specification/2025-06-18/basic/transports
• https://nvd.nist.gov/vuln/detail/CVE-2026-59822
• https://github.com/webpro255/awesome-ai-agent-attacks

Related merged contributions from this contributor

• PR #16699 — Anthropic sk-ant-* API-key detector (merged)
• PR #16701 — .claude/settings.json / .mcp.json project settings exposure detector (merged)
• PR #16734 — .claude/agents/*.md subagent config exposure detector (open, CI green)

This one extends coverage from Anthropic-specific patterns to the wider MCP ecosystem — a much larger detection population than the Anthropic-specific templates.