MCP (Model Context Protocol) configuration files allow specific softwares such as IDEs like Cursor to interact with MCP servers. These files may contain sensitive information which could assist an attack to conduct further attacks.

Model Context Protocol (MCP) Server Tool Poisoning occurs when malicious actors manipulate tool configurations or metadata on a malicious MCP server. This can lead to the execution of unauthorized commands, data corruption, or the deployment of malicious tools. Such vulnerabilities are particularly dangerous in AI development environments, where poisoned tools can compromise the integrity of the development process and lead to further exploitation. This detection is included in the AI and LLM category.

This is an informational notice that the scanner was able to detect a Model Context Protocol (MCP) HTTP server (using SSE or Streamable-HTTP transport mode) on the target server.

Model Context Protocol (MCP) Server Prompt Injection occurs when malicious actors use tools response to inject malicious prompts to the calling LLM through the MCP client. This can lead to the execution of unauthorized commands, data corruption, or the deployment of malicious tools. Such vulnerabilities are particularly dangerous in AI development environments, where malicious tools can compromise the integrity of the development process and lead to further exploitation. This detection is included in the AI and LLM category.

This is an informational notice that the scanner was able to detect an MCP (Model Context Procol) manifest on the target server.

This is an informational notice that the scanner was able to detect an MCP (Model Context Procol) Inspector instance on the target server.

This is an informational notice that the scanner was able to detect a Model Context Protocol (MCP) server available without authentication on the target server. When available, the plugin provides the list of tools, prompts and resources in the attachments.

ModelContextProtocol (MCP) servers using SSE (Server-Sent Events) transport mode are prone to DNS rebinding attacks when they do not enforce strict verification of both the 'Origin' and 'Host' headers. This vulnerability allows an attacker to bypass same-origin policies, potentially leading to unauthorized access to sensitive data or actions on behalf of the user in the context of the vulnerable MCP server.

This detection is included in the AI and LLM category.

OAuth Dynamic Client Registration allows for various metadata fields such as 'client_name', 'website_uri' during the registration process. When the OAuth server accepts permissive values for such fields, such as ones starting with javascript://, an attacker could exploit this to perform Cross-Site Scripting (XSS) attacks. OAuth Dynamic Client Registration is very common in the context of Model Context Protocol (MCP) servers, allowing attackers to target AI developers

This is an informational plugin to inform the user that the scanner has detected a publicly accessible OAuth Dynamic Client Registration endpoint on the target application. OAuth Dynamic Client Registration allows clients to register dynamically with an authorization server and is very common in the context of Model Context Protocol (MCP) servers used for AI development.

According to the self-reported version number, the version of MCP Inspector hosted on the remote is affected by a Remote Code Execution vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This detection is included in the AI and LLM category.

OAuth Dynamic Client Registration requires specifying redirect URIs during the registration process. When the OAuth server accepts permissive redirect URIs, such as those allowing arbitrary hosts or ones starting with javascript://, an attacker could exploit this to perform Open Redirect or Cross-Site Scripting (XSS) attacks. OAuth Dynamic Client Registration is very common in the context of Model Context Protocol (MCP) servers, allowing attackers to target AI developers.

ID	Name	Product	Family	Published	Updated	Severity
114803	MCP Client Configuration File Detected	Web App Scanning	Data Exposure	5/23/2025	5/23/2025	medium
114921	MCP Server Tool Poisoning	Web App Scanning	Artificial Intelligence	7/18/2025	7/18/2025	high
114790	MCP Server Detected	Web App Scanning	Artificial Intelligence	5/22/2025	7/22/2025	info
114928	MCP Server Prompt Injection	Web App Scanning	Artificial Intelligence	7/31/2025	7/31/2025	high
114793	MCP Manifest Detected	Web App Scanning	Artificial Intelligence	5/22/2025	5/22/2025	info
114797	MCP Inspector Detected	Web App Scanning	Artificial Intelligence	5/22/2025	5/22/2025	info
114791	MCP Server Unauthenticated Access	Web App Scanning	Artificial Intelligence	6/11/2025	6/18/2025	info
114885	MCP Server SSE DNS Rebinding	Web App Scanning	Artificial Intelligence	6/20/2025	7/3/2025	medium
114920	OAuth Dynamic Client Registration Permissive Metadata Field	Web App Scanning	Web Applications	7/18/2025	7/18/2025	low
114918	OAuth Dynamic Client Registration Detected	Web App Scanning	Web Applications	7/18/2025	7/18/2025	info
114906	MCP Inspector < 0.14.1 Remote Code Execution	Web App Scanning	Artificial Intelligence	7/4/2025	7/4/2025	critical
114919	OAuth Dynamic Client Registration Permissive Redirect URI	Web App Scanning	Web Applications	7/18/2025	7/18/2025	low

Detections

Analytics

Plugins Search

medium

high

info

high

info

info

info

medium

low

info

critical

low