MCP Server Found

Description

An application or environment was found to expose or integrate a Model Context Protocol (MCP) server. MCP servers can provide language models and connected clients with access to tools, resources, and external services. The presence of an MCP server is not inherently a vulnerability, but it introduces an additional attack surface that should be assessed for authentication, authorization, input validation, data exposure, and secure handling of tool execution.

Recommendation

Inventory the MCP server and the tools, resources, and services it exposes. Verify that access controls are appropriate for the intended use, apply least-privilege permissions where applicable, validate inputs, and review the security of tool execution and downstream integrations. Disable unused capabilities and ensure that sensitive operations require appropriate authorization.

References

• Model Context Protocol: Security Best Practices
• Model Context Protocol