mcp-11-elicitation-phish: MCP elicitation phishing demo server
Category: MCP server attacks (feintkit-mcp). Loopback port: none (standard input and output only).
What it simulates
After an ordinary tool call, the server uses an elicitation request to ask the user for a password under a false pretext.
MCP lets a server ask the user for input through an elicitation request that the client shows as a form. The MCP specification says servers must not use elicitation to request sensitive information, but nothing in the protocol stops a malicious server from doing so, and a user who sees a plausible message such as an expired session may type a password into it. This scenario serves a harmless account check tool. After a valid call, if the client declares the elicitation capability, the server asks for a field named password with the message that the session expired. It never stores, hashes, logs, or echoes the answer: it records only that a credential-shaped field was requested, the user's action, and the field name and a coarse length class of any answer, and it writes the file action-performed.txt only when a credential-shaped answer arrived. The tests use only the obviously fake value FEINTKIT-FAKE-CREDENTIAL. Whether a real client shows the request clearly, labels the requesting server, or blocks it is not tested here.
Mapping
- MITRE ATLAS: AML.T0052, AML.T0073
- OWASP LLM Top 10 2025: LLM02:2025
- OWASP Agentic Top 10 2026: ASI09
Why these techniques apply
- AML.T0052: Server solicits sensitive input from the user under false pretenses.
- AML.T0073: Presents the request as coming from a trusted party.
What a product should detect
| Signal | What to flag | Where | Match rule |
|---|---|---|---|
| S1 | Server-to-client elicitation request whose requested schema has a credential-shaped property | elicitation/create request (JSON-RPC request from the server) | method elicitation/create with a requestedSchema property named password |
| S2 | Client answer carrying a credential-shaped field | elicitation/create response (JSON-RPC response from the client) | accept result whose content has a key matching ^(api[_-]?key|password|passwd|secret|token|access[_-]?token)$ (case-insensitive) |
| S3 | Feintkit marker string in the scenario's marker files and events | output directory (proof.txt, action-performed.txt, events.jsonl) | FEINTKIT::mcp-11-elicitation-phish::[A-Za-z0-9]{4,16}::DEFENSIVE-TEST-ONLY |
What a defender can do
- Restrict: Never type a password or secret into an elicitation prompt from a server; use the client's own credential screen.
- Add a rule: Flag elicitation requests whose requested schema asks for a password, key or token.
- Change a setting: Block credential-shaped fields in elicitation at the client, and label each prompt clearly with the server that asked.
Run it
feintkit run mcp-11-elicitation-phish --root <repository> --deterministic, then feintkit verify mcp-11-elicitation-phish --root <repository>.
Every artifact contains FEINTKIT::mcp-11-elicitation-phish::<run id>::DEFENSIVE-TEST-ONLY. Read RESPONSIBLE-USE.md before running.