> For the complete documentation index, see [llms.txt](https://ai-security-docs.akto.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ai-security-docs.akto.io/akto-argus-agentic-ai-security-for-homegrown-ai/probe-library/mcp-security-library.md). # MCP Security Probe Library Probe Library for OWASP MCP Top 10 for Security in Akto This section documents the **MCP Security Probe Library** built by Akto to probe Model Context Protocol (MCP) servers, tools, agents, and downstream integrations. Each probe represents a **concrete, executable security probe** that targets a specific MCP failure mode. Probes are organized by **MCP OWASP Top 10 category** and are executed using real MCP protocol flows (JSON-RPC, function calls, tool execution, session handling). > **Note**\ > The lists below show representative probes for each category. The full library contains **4,000+ MCP and agentic security probes** and continues to expand. ### MCP01: Token Mismanagement & Secret Exposure Probes in this category validate whether authentication tokens, session identifiers, and secrets are properly handled across MCP requests, tool calls, and downstream APIs. #### Sample Probes in Akto Probe Library * MCP Token Passthrough API Key * MCP Token Passthrough Downstream * MCP Token Passthrough Opaque Token * Authentication Token Reflection in Response MCP * Authentication Token Reflection in Headers MCP * Replace Auth Token MCP * MCP Remove Tokens * Authentication With Wrong Auth Scheme MCP * MCP Predictable Session IDs * MCP Session State Persistence * MCP Session Not Bound to User * MCP Session Must Use per Request Auth * MCP Session Hijacking Prompt Injection * MCP Session Hijacking Filtered Attack *** ### MCP02: Privilege Escalation via Scope Creep Validates whether MCP function calls and tools allow unauthorized privilege expansion through parameter manipulation, excessive invocation, or input validation bypass. #### Sample Probes in Akto Probe Library * MCP Function Call Privilege Escalation * MCP Unauthorized Tool Access * MCP Function Call Direct Method Manipulation * MCP Function Call Excessive Invocation * MCP Excessive Resource Reads Rate Limit * Improper Page Size Handling MCP * MCP Param Overload * Bypass Input Length Validation MCP * Bypass Input Validation With Null Values MCP * Input Validation by Passing Unsupported MCP Method * Input Validation by Passing Unsupported JSONRPC Version * Input Validation by Replacing Param With Array MCP * Input Validation for Boolean MCP * MCP Invalid Request Removed Param * MCP Invalid Params *** ### MCP03: Tool Poisoning Probes whether tool outputs, metadata, or execution paths can be manipulated to influence agent behavior or bypass safety controls. #### Sample Probes in Akto Probe Library * Tool Poisoning Output Injection MCP * MCP Function Call Output Manipulation * MCP Function Call Response Manipulation * MCP TPA Tool Metadata Injection * MCP TPA Obfuscated Output Payloads * MCP TPA Override Safety Checks * MCP Elicitation Abuse General *** ### MCP04: Software Supply Chain Attacks & Dependency Tampering Validates whether MCP implementations securely handle external resources, dependencies, SDK references, and content types. #### Covered Probe Templates * MCP Resource Binary URI Deserialization Attack * Hallucinated SDK Package Suggestion * MCP Path Traversal Resource URI * MCP Path Traversal Parameter Injection * MCP Invalid Origin Header Rebinding * MCP Invalid MIME Type Injection *** ### MCP05: Command Injection & Execution Probes whether MCP tools or resources can be abused to execute arbitrary commands or escape execution boundaries. #### Sample Probes in Akto Probe Library * MCP Remote Command Injection RCE * MCP Command Injection Parameter Injection * Command Injection by Passing Extra Values MCP * MCP Tools Call Code Injection * MCP Tools Call Code Injection Sandbox Escape * MCP Tools Call Shell Like Command * MCP Resources Read Code Injection * MCP Indirect Prompt Injection Command Injection Agent Test * MCP Command Injection With Operators * MCP Command Injection With Redirection and Var Manipulation * MCP Command Injection With Redirection and Var Manipulation Chained * MCP Command Injection Variable Assign * MCP Command Injection Variable Assign Chained * MCP Command Injection User Agent Header Chained * MCP Command Injection URL Path * MCP Command Injection URL Path Chained * MCP Command Injection Time Delay * MCP Command Injection Time Delay Chained * MCP Command Injection Curl Http Request * MCP Command Injection Curl Http Request Chained Commands *** ### MCP06: Prompt Injection via Contextual Payloads Validates whether prompts, tool parameters, resources, or metadata can be abused to override agent behavior or bypass safeguards. #### Sample Probes in Akto Probe Library * MCP Direct Prompt Injection * MCP Indirect Prompt Injection * MCP Resource Prompt Injection * MCP Indirect Prompt Injection Tool Bypass * MCP Indirect Prompt Injection Tool Bypass Agent Test * MCP Indirect Prompt Injection Response Body * MCP Function Call Parameter Injection * MCP Function Call Nested Parameter Injection * MCP Ping Parameter Injection * MCP XSS Injection Parameter Injection * MCP SQL Injection Parameter Injection * MCP LDAP Injection Parameter Injection * MCP Path Traversal Parameter Injection * Prompt Injection Markdown Abuse Injection * MCP Function Call Params Name Manipulation * MCP Function Call Metadata Injection * MCP ANSI Cursor Manipulation Deception * MCP ANSI Hyperlink Manipulation Deception * MCP ANSI Invisible Text Deception * MCP ANSI Screen Clearing Deception * MCP Consent Fatigue Exploitation *** ### MCP07: Insufficient Authentication & Authorization Scans whether authentication and authorization are consistently enforced across MCP sessions, tools, and function calls. #### Sample Probes in Akto Probe Library * MCP Session Hijacking Prompt Injection * MCP Session Hijacking Filtered Attack * MCP Session Not Bound to User * MCP Session Must Use per Request Auth * MCP Session State Persistence * Authentication With Wrong Auth Scheme MCP * MCP Remove Tokens * Replace Auth Token MCP * MCP Predictable Session IDs * MCP Unauthorized Tool Access * MCP Function Call Privilege Escalation * MCP Invalid Request Removed Param *** ### MCP08: Lack of Audit and Telemetry Validates whether MCP implementations provide sufficient logging, error handling, and resilience against abuse and denial-of-service conditions. #### Sample Probes in Akto Probe Library * MCP Missing Log for Security Errors * MCP Reflective Invalid Tool Calls * MCP Method Not Found * MCP Timeout Not Handled Properly * MCP Internal Error Exposure * MCP Unhandled Error Disclosure Malformed JSONRPC * MCP Ping Missing Response * MCP Ping Invalid JSONRPC * MCP Ping Slow Response * MCP Ping Timing Information Leak * MCP Ping No Rate Limiting * MCP Ping Flooding DOS * MCP Ping Amplification Attack * DOS Test URL MCP * Date Field DOS MCP * JSON Body Param Bombing DOS MCP * DOS Test Large Numbers MCP * DOS File URL CSV MCP * DOS Header Key MCP * DOS Header Value MCP *** ### MCP09: Shadow MCP Servers Probes whether internal MCP infrastructure, models, tools, or configuration details can be discovered or fingerprinted by an attacker. #### Sample Probes in Akto Probe Library * MCP Tools List Extraction via Parameters * MCP Internal System Details Extraction * MCP Model Name Extraction via Parameters * MCP Configuration Information Extraction * MCP Environment Variables Extraction * MCP Debug Information Extraction * MCP Model Architecture Probe * MCP Model Backend Fingerprinting * MCP Model Capability Inference * MCP Model Param Inference * MCP Model Asset Exfiltration by Prompt * MCP Scan Dev Infra by Prompt * MCP Browser Driver Version Disclosure (LT) * MCP WebDriver Session ID Exposure (LT) * File System Path Disclosure *** ### MCP10: Context Injection & Over-Sharing Validates whether MCP systems correctly isolate context, memory, and data across sessions, agents, and tools. #### Sample Probes in Akto Probe Library * MCP Context Bleed * MCP Shared Memory Context Leakage * MCP Global Memory Buffer Leakage * MCP Cross Session Context Bleeding * MCP Vector Store Context Bleeding * MCP Conversation History Theft * MCP Conversation History Extraction via Parameters * MCP Tool Call History Extraction via Parameters * MCP Chain of Thought Extraction via Parameters * MCP System Prompt Extraction * MCP System Prompt Extraction via Parameters * MCP Response Data Leak Check * Memory Leak or Object Dump MCP * MCP Data Retention and Source Disclosure * MCP Data Exfiltration Reflection Attack * MCP Shell Configuration Override Attack