skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

testing-mcp-server-security

Tests MCP servers and clients for tool poisoning, prompt injection, and config trust bypasses.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#ai security#prompt injection#tool poisoning#burp suite#RCE#mcp security
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill testing-mcp-server-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-mcp-server-security
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ai-security/testing-mcp-server-security
Command: npx skills add https://github.com/xalgord/xalgorix --skill testing-mcp-server-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires mcp.

What problem does it solve?

AI agents and IDEs that load Model Context Protocol (MCP) servers inherit serious trust risks: malicious tool descriptions can inject instructions into the model, local stdio servers can read user credentials, and config trust bypasses can yield RCE. This Skill provides a structured methodology to find and prove these issues during authorized penetration tests.

Core Features & Use Cases

  • Tool Poisoning & Injection Testing: Build test MCP servers with the Python mcp SDK to hide instructions in tool descriptions, parameter names, and outputs, then confirm execution via OOB callbacks.
  • Credential Exposure & Config Trust Assessment: Model what a hostile stdio server could read (SSH keys, AWS/cloud credentials) and test MCPoison-style config swap bypasses (CVE-2025-54136) with benign marker payloads.
  • Host RCE & Fuzzing: Test Flowise CustomMCP unauthenticated RCE (CVE-2025-59528, CVE-2025-8943) and fuzz SSE/WebSocket MCP endpoints through Burp with the MCP-ASD extension.
  • Use Case: During an authorized assessment of a Cursor-based developer environment, verify whether an approved MCP config entry can have its command swapped post-approval and execute on project reopen without re-prompting.

Quick Start

Ask the agent to map the target MCP architecture and test the server for tool poisoning by building a FastMCP test server with a hidden instruction in a tool description, confirming execution through an OOB callback.

Frequently Asked Questions about testing-mcp-server-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test an MCP server for tool poisoning?▼

Build a test server with the Python mcp SDK (FastMCP) whose tool description embeds hidden instructions, then observe whether the client acts on them when invoking the tool. Confirm execution through an OOB callback or benign marker file rather than real credential access.

What tools are used for MCP server penetration testing?▼

The workflow uses the Python mcp SDK and mcp dev inspector to enumerate tools, Burp Suite with the MCP-ASD extension to fuzz SSE/WebSocket transports, Metasploit modules for Flowise RCE, and OOB/canary infrastructure to confirm exploitation.

Can a local MCP server steal SSH or AWS credentials?▼

Yes. A stdio MCP server runs with the user's OS privileges and can read ~/.ssh/id_*, ~/.aws/credentials, ~/.kube/config, and similar files without privilege escalation. Testing should prove read access only against seeded canary files, never real secrets.

What is the MCPoison config trust bypass (CVE-2025-54136)?▼

Cursor bound trust to the MCP entry name rather than its command and args, so swapping the command after user approval executed it on project reopen with no re-prompt. It was fixed in Cursor v1.3, which forces re-approval on any MCP config change.

Does this testing require authorization and an isolated environment?▼

Yes. The methodology requires a written agreement covering the MCP servers, clients, and host workstations in scope, plus an isolated test workstation and OOB sink. Untrusted MCP servers should never run on a real host.

Related Skills

Explore More Software Engineering Skills→
519lab519lab
2

fastmcp

Automate creating, testing, and deploying Python MCP servers with HTTP endpoints.

Official
Intermediate
Ap6packAp6pack
4

report-template

Converts security findings into formatted bug bounty submissions and client engagement reports.

Community
Advanced
bigeasyfreemanbigeasyfreeman
2

owasp-llm-security

Assess LLM-integrated systems against the OWASP Top 10 for LLM Applications.

Community
Advanced
robit-manrobit-man

supply-chain-forensics

Analyze dependency integrity, build pipelines, and SBOM composition for supply chain security.

Community
Advanced