MCP red teaming & security scanner — enumerate, probe, and exploit Model Context Protocol servers
mcpnuke exposes 4 tools with basic schemas and descriptions, but falls short of production quality. All tools have descriptions (10-60 chars, below the 50-200 char baseline for LLM optimization) and input schemas with type definitions. However, parameter descriptions are sparse or missing entirely. The ticket.create tool lacks descriptions for both 'title' and 'body' parameters. No output schemas are documented. Error handling is minimal, no recovery guidance, no categorization of retryable vs fatal errors. The tool set mixes read-only operations (docs.search, file.read, http.fetch) with a write operation (ticket.create) without clear permission boundaries or audit trails. No tool annotations (readOnlyHint, destructiveHint) are present despite the risk taxonomy being declared.
Search the product documentation and return matching lines.
Read a UTF-8 text file from the documentation directory.
Fetch a page from an approved documentation host.
File a support ticket with a title and body.
ticket.create parameters 'title' and 'body' lack descriptions entirely. LLMs cannot infer what content is expected or constraints (e.g., is title a one-liner? can body contain markdown?).
No output schemas documented for any tool. LLMs cannot plan downstream operations or extract required fields (e.g., does ticket.create return a ticket_id for follow-up calls?).
Tool descriptions are 10-60 characters, well below the 50-200 char baseline. 'Search the product documentation and return matching lines' (60 chars) lacks context on when to use this vs file.read, what 'matching' means, or result format.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite the server declaring Risk taxonomy (READ_ONLY, WRITE). ticket.create should be marked destructiveHint=true to signal irreversibility.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | 2026-07-28+ | v2 |
Error handling is absent. No recovery guidance (e.g., 'file not found, try docs.search()'), no error categorization (retryable vs fatal), no actionable error messages. Raw HTTP errors will confuse LLMs.