---
title: "Exposed MCP Server Scanner"
canonical: https://trickest.com/library/exposed-mcp-server-scanner
description: "Scan a target domain with subfinder and httpx for MCP servers, then write authentication, capability, and poisoning-risk findings to JSONL."
---

# Exposed MCP Server Scanner

## Overview

An MCP server can be reachable without appearing in your asset inventory. A development endpoint, acquired domain, or forgotten integration may answer without authentication and advertise tools, prompts, or resources that nobody reviewed.

This workflow gives you a domain-wide MCP inventory for [exposure management](/use-cases/exposure-management). It records which endpoints require authentication, counts the capabilities exposed by those that do not, and marks descriptions that contain instruction overrides, concealment directives, hidden text, or broad system access. Keep each `findings.jsonl` from scheduled runs to review new servers and changed capability descriptions.

[subfinder](/tools/subfinder) expands the target domain, [httpx](/tools/httpx) keeps hosts that answer over HTTP, and the MCP discovery script tests common protocol paths. It initializes each confirmed server, lists unauthenticated capabilities, and ranks the review queue without calling any advertised tool.

## Pipeline

1. Enumerate. [subfinder](/tools/subfinder) reads the target domain and writes the discovered hostname file.
2. Probe. [httpx](/tools/httpx) reads that file and writes a folder containing the hosts that answer over HTTP.
3. Analyze. MCP discovery + tool-poisoning triage (`mcpdiscover`) reads the httpx folder, tests five common MCP paths, inventories unauthenticated capabilities, and writes `findings.jsonl`.

## Inputs

- **Target domain.** The apex domain passed to subfinder. The graph defaults to `deepwiki.com`; replace it with a domain your team owns or has permission to assess before running.

## Outputs

- **Subdomain file.** The hostname list returned by subfinder and passed to httpx.
- **HTTP probe folder.** The httpx artifacts used by the MCP discovery script to collect candidate base URLs.
- **findings.jsonl.** A summary row, one server row per confirmed MCP endpoint, and one row per flagged tool, prompt, or resource description.

## Integrations

- [subfinder](/tools/subfinder) enumerates hostnames from the target domain.
- [httpx](/tools/httpx) identifies which discovered hosts answer over HTTP.

## Sample output

Illustrative `findings.jsonl` only. All domains and values below are fictional. No request was sent to produce them.

```jsonl
{"kind":"summary","exposed_mcp_servers":1,"unauthenticated":1,"risky_items":1,"scanned_at":"2026-08-16T12:30:00Z"}
{"url":"https://mcp.example.test/mcp","kind":"server","serverInfo":{"name":"sample-mcp","version":"1.0"},"auth_required":false,"counts":{"tools":2,"prompts":1,"resources":1},"risky_items":1,"blast_radius":"high","severity":"high","scanned_at":"2026-08-16T12:30:00Z"}
{"url":"https://mcp.example.test/mcp","kind":"tool","name":"sample_system_runner","risk_flags":["imperative-directive","broad-capability"],"detail":"Fictional description included only to show the output shape.","auth_required":false,"severity":"high","scanned_at":"2026-08-16T12:30:00Z"}
```

## FAQ

### Does the scanner call tools on an MCP server?

No. It initializes the server and requests the available MCP capability lists. It does not invoke an advertised tool or read a listed resource.

### Does HTTP 401 or 403 indicate authentication?

The script sets `auth_required` to true when initialization returns HTTP 401 or 403. If initialization succeeds without credentials, it continues with the capability inventory.

### Will the workflow generate much traffic?

subfinder uses its configured discovery sources, then httpx probes the returned hosts. The script checks up to 250 candidate base URLs across five common MCP paths, with a 12 second request timeout and one confirmed path retained per host.

### Is a poisoning-risk flag proof of exploitation?

No. The script uses pattern checks on capability names and descriptions to find instruction overrides, concealment language, hidden Unicode, encoded blobs, and broad system actions. Treat each flag as a review lead, not a confirmed exploit.

### Can I compare scheduled runs?

Yes. Schedule it through [Trickest workflows](/platform/workflows) and retain each `findings.jsonl` for comparison. This graph produces timestamped findings but does not calculate the diff for you.

## Related workflows

- [MCP Trust Boundary Suite](/library/mcp-trust-boundary-suite). Reach for this instead when you have MCP configuration and channel inputs and want a trust-boundary inventory rather than internet discovery.
- [Web AI Agent Audit](/library/web-ai-agent-audit). Reach for this instead when the target is an embedded web agent rather than an MCP endpoint.
- [Domain OSINT & Footprinting](/library/domain-osint-and-footprinting). Reach for this instead when you need a broader domain profile before active MCP probing.

---
_Markdown source of https://trickest.com/library/exposed-mcp-server-scanner._