Skip to content

Add MCPAuthBypassTarget for OWASP MCP-07 authentication bypass testing#1567

Open
tejas0077 wants to merge 1 commit intomicrosoft:mainfrom
tejas0077:feat/mcp-auth-bypass-clean
Open

Add MCPAuthBypassTarget for OWASP MCP-07 authentication bypass testing#1567
tejas0077 wants to merge 1 commit intomicrosoft:mainfrom
tejas0077:feat/mcp-auth-bypass-clean

Conversation

@tejas0077
Copy link
Copy Markdown

Adds a new MCPAuthBypassTarget for red-teaming MCP server endpoints against authentication bypass vulnerabilities (OWASP MCP-07).

Relates to #1470

Four bypass techniques supported:

  • no_auth: requests with no Authorization header
  • empty_token: empty Bearer token
  • malformed_token: truncated/invalid JWT
  • role_escalation: tampered JWT with alg:none attack and admin role claims

Results are classified as VULNERABILITY DETECTED, SECURE, or INVESTIGATE based on the server HTTP response code.

Tests and Documentation:

  • 11 unit tests covering init validation, all 4 bypass techniques, and all response scenarios
  • All 11 tests passing locally
  • Ruff linting clean

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant