Exposed MCP Server Scanner

Overview

An MCP server can be reachable without appearing in your asset inventory. A development endpoint, acquired domain, or forgotten integration may answer without authentication and advertise tools, prompts, or resources that nobody reviewed.

This workflow gives you a domain-wide MCP inventory for exposure management. It records which endpoints require authentication, counts the capabilities exposed by those that do not, and marks descriptions that contain instruction overrides, concealment directives, hidden text, or broad system access. Keep each findings.jsonl from scheduled runs to review new servers and changed capability descriptions.

subfinder expands the target domain, httpx keeps hosts that answer over HTTP, and the MCP discovery script tests common protocol paths. It initializes each confirmed server, lists unauthenticated capabilities, and ranks the review queue without calling any advertised tool.

Pipeline

1. Enumerate. subfinder reads the target domain and writes the discovered hostname file.
2. Probe. httpx reads that file and writes a folder containing the hosts that answer over HTTP.
3. Analyze. MCP discovery + tool-poisoning triage (mcpdiscover) reads the httpx folder, tests five common MCP paths, inventories unauthenticated capabilities, and writes findings.jsonl.

Inputs

• Target domain. The apex domain passed to subfinder. The graph defaults to deepwiki.com; replace it with a domain your team owns or has permission to assess before running.

Outputs

• Subdomain file. The hostname list returned by subfinder and passed to httpx.
• HTTP probe folder. The httpx artifacts used by the MCP discovery script to collect candidate base URLs.
• findings.jsonl. A summary row, one server row per confirmed MCP endpoint, and one row per flagged tool, prompt, or resource description.

Integrations

• subfinder enumerates hostnames from the target domain.
• httpx identifies which discovered hosts answer over HTTP.

Sample output

Illustrative findings.jsonl only. All domains and values below are fictional. No request was sent to produce them.

kind	exposed_mcp_servers	unauthenticated	risky_items	scanned_at	url	serverInfo	auth_required	counts	blast_radius	severity	name	risk_flags	detail
summary	1	1	1	2026-08-16T12:30:00Z	null	null	null	null	null	null	null	null	null
server	null	null	1	2026-08-16T12:30:00Z	https://mcp.example.test/mcp	{"name":"sample-mcp","version":"1.0"}	false	{"tools":2,"prompts":1,"resources":1}	high	high	null	null	null
tool	null	null	null	2026-08-16T12:30:00Z	https://mcp.example.test/mcp	null	false	null	null	high	sample_system_runner	imperative-directive, broad-capability	Fictional description included only to show the output shape.

FAQ

Does the scanner call tools on an MCP server?

No. It initializes the server and requests the available MCP capability lists. It does not invoke an advertised tool or read a listed resource.

Does HTTP 401 or 403 indicate authentication?

The script sets auth_required to true when initialization returns HTTP 401 or 403. If initialization succeeds without credentials, it continues with the capability inventory.

Will the workflow generate much traffic?

subfinder uses its configured discovery sources, then httpx probes the returned hosts. The script checks up to 250 candidate base URLs across five common MCP paths, with a 12 second request timeout and one confirmed path retained per host.

Is a poisoning-risk flag proof of exploitation?

No. The script uses pattern checks on capability names and descriptions to find instruction overrides, concealment language, hidden Unicode, encoded blobs, and broad system actions. Treat each flag as a review lead, not a confirmed exploit.

Can I compare scheduled runs?

Yes. Schedule it through Trickest workflows and retain each findings.jsonl for comparison. This graph produces timestamped findings but does not calculate the diff for you.

Related workflows

• MCP Trust Boundary Suite. Reach for this instead when you have MCP configuration and channel inputs and want a trust-boundary inventory rather than internet discovery.
• Web AI Agent Audit. Reach for this instead when the target is an embedded web agent rather than an MCP endpoint.
• Domain OSINT & Footprinting. Reach for this instead when you need a broader domain profile before active MCP probing.