Up to 20 checks across 4 categories, mapped to the OWASP MCP Security Top 10. Only tests that produce definitive PASS/FAIL results are included in your report.
Authentication & Authorization
1
Authentication required — real MCP initialize probe
2
MCP manifest required fields (auth, scopes, version, contact)
Protocol Security
1
Tool enumeration without auth (tools/list)
2
Tool execution without auth (tools/call)
3
Scope boundary validation — unknown tool rejection
4
TLS configuration — HSTS enforcement
5
Auth token validation — invalid & alg:none JWT rejection
Vulnerability Testing
1
Prompt injection resistance — 3 payload variants
2
SSRF via tool parameters — metadata endpoint probe
3
Input size limits — 100 KB DoS resistance
4
Rate limiting — header check + 5-request burst
5
CORS policy — origin reflection test
6
Output sanitization — XSS prevention in tool responses
7
Error information leakage — stack trace detection
8
Schema validation — type confusion & prototype pollution
9
Security headers — CSP, XFO, XCTO, Referrer-Policy