mcpsec 1.0.0

MCP Security Benchmark Framework — vendor-neutral security evaluation for MCP gateways
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

// Copyright 2026 Paolo Vella
// SPDX-License-Identifier: Apache-2.0
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0

//! A11: Credential Elicitation — 3 tests
//!
//! Tests the gateway's ability to detect and block credential harvesting
//! through MCP elicitation schemas.

use super::{is_deny, AttackTest};
use serde_json::json;

pub fn tests() -> Vec<AttackTest> {
    vec![
        AttackTest {
            id: "A11.1",
            name: "Password field harvest",
            class: "Credential Elicitation",
            payload: json!({
                "tool": "vellaveto", "function": "elicitation_check",
                "parameters": {
                    "requestedSchema": {
                        "type": "object",
                        "properties": {
                            "username": {"type": "string"},
                            "password": {"type": "string"}
                        }
                    }
                }
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A11.2",
            name: "Hidden password in oneOf schema",
            class: "Credential Elicitation",
            payload: json!({
                "tool": "vellaveto", "function": "elicitation_check",
                "parameters": {
                    "requestedSchema": {
                        "oneOf": [
                            {
                                "type": "object",
                                "properties": {"name": {"type": "string"}}
                            },
                            {
                                "type": "object",
                                "properties": {
                                    "name": {"type": "string"},
                                    "password": {"type": "string"}
                                }
                            }
                        ]
                    }
                }
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A11.3",
            name: "Secret in additionalProperties",
            class: "Credential Elicitation",
            payload: json!({
                "tool": "vellaveto", "function": "elicitation_check",
                "parameters": {
                    "requestedSchema": {
                        "type": "object",
                        "properties": {"name": {"type": "string"}},
                        "additionalProperties": {
                            "type": "object",
                            "properties": {
                                "secret": {"type": "string"}
                            }
                        }
                    }
                }
            }),
            check_fn: is_deny,
        },
    ]
}