MCP Attacks
| Test Name | API ID | Description | Detectable Vulnerabilities |
|---|---|---|---|
| AESI: ANSI Escape Sequence Injection | aesi | Checks whether MCP tools, resources, or prompt templates can fetch external content and return ANSI-concealed instructions that are hidden from terminal users but still visible to downstream models | AESI: ANSI Escape Sequence Injection |
| Stored AESI: ANSI Escape Sequence Injection | stored_aesi | Checks whether MCP integrations can persist externally hosted ANSI-concealed instructions and expose them later to downstream models | Stored AESI: ANSI Escape Sequence Injection |
| MCP Predictable Session ID | mcp_predictable_session_id | Checks whether an MCP server generates Mcp-Session-Id values with enough randomness to prevent an attacker from guessing a valid session and hijacking another client's MCP session | MCP Predictable Session ID |
| MCP Session ID as Authentication | mcp_session_as_auth | Checks whether the MCP server re-verifies application-level authentication on every request or relies on the session ID alone, allowing session-replay attacks | MCP Session ID as Authentication |
| MCP Lack of Session Invalidation | mcp_session_not_invalidated | Checks whether the MCP server actually removes sessions when it confirms termination via HTTP DELETE, preventing post-logout session reuse | MCP Lack of Session Invalidation |
Updated 12 days ago
Did this page help you?