mcp-13-exposed-local-server: Exposed local MCP server demo
Category: MCP server attacks (feintkit-mcp). Loopback port: 47113.
What it simulates
A local MCP server is reachable without authentication on a network interface it should not listen on.
MCP servers meant for local use are often started over HTTP with no credential check. The MCP specification asks local servers to bind only to localhost, to validate the Origin header, and to authenticate connections; a server bound to all interfaces without these protections can be reached by other machines on the network, found by scanning, or driven by a web page through DNS rebinding. This scenario keeps the suite's loopback-only rule, so the exposure is simulated: it serves a real unauthenticated MCP endpoint over HTTP on 127.0.0.1 only, while its banner, instructions and events claim a wildcard bind (0.0.0.0). An exposure_simulated event records what a real wildcard bind with no authentication would have exposed. The file action-performed.txt records that a client called the tool without any credential. Whether a product detects a socket that is really reachable from the network is not tested here.
Mapping
- MITRE ATLAS: AML.T0132, AML.T0006.002, AML.T0049
- OWASP LLM Top 10 2025: none
- OWASP Agentic Top 10 2026: none
Why these techniques apply
- AML.T0132: Server bound beyond loopback without access controls.
- AML.T0006.002: Such servers are discoverable by scanning.
- AML.T0049: Exposed service is reachable as a public-facing application.
What a product should detect
| Signal | What to flag | Where | Match rule |
|---|---|---|---|
| S1 | Unauthenticated MCP initialize and tools/list over HTTP to the loopback endpoint, with no credential header | loopback interface, port 47113 (or the port in FEINTKIT_HTTP_PORT), path /mcp | POST /mcp with a JSON-RPC body containing "method":"tools/list" and no Authorization header |
| S2 | Banner and instructions that claim a wildcard bind and no authentication | GET /.well-known/feintkit-exposure response and the instructions field of the initialize result | "claimedBind":"0.0.0.0: |
| S3 | Feintkit marker string in the scenario's marker files and events | output directory (proof.txt, action-performed.txt, events.jsonl) | FEINTKIT::mcp-13-exposed-local-server::[A-Za-z0-9]{4,16}::DEFENSIVE-TEST-ONLY |
What a defender can do
- Restrict: Bind local servers to loopback only, and require authentication for any server that can be reached from the network.
- Add a rule: Alert on an MCP server that answers initialize or tool-list requests without authentication on a non-loopback interface.
- Change a setting: Set the server's listen address to 127.0.0.1, add a firewall rule for its port, and require a token on each request.
Run it
feintkit run mcp-13-exposed-local-server --root <repository> --deterministic, then feintkit verify mcp-13-exposed-local-server --root <repository>.
Every artifact contains FEINTKIT::mcp-13-exposed-local-server::<run id>::DEFENSIVE-TEST-ONLY. Read RESPONSIBLE-USE.md before running.