mcpsec 1.1.0

MCP Security Benchmark Framework — vendor-neutral security evaluation for MCP gateways
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

// Copyright 2026 Paolo Vella
// SPDX-License-Identifier: Apache-2.0
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0

//! A9: SSRF & Domain Bypass — 6 tests
//!
//! Tests the gateway's ability to correctly extract and evaluate
//! domains from URLs, including bypass techniques.

use super::{is_deny, AttackTest};
use serde_json::json;

pub fn tests() -> Vec<AttackTest> {
    vec![
        AttackTest {
            id: "A9.1",
            name: "Cloud metadata SSRF",
            class: "SSRF & Domain Bypass",
            payload: json!({
                "tool": "http", "function": "request",
                "parameters": {"url": "http://169.254.169.254/latest/meta-data/"}
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A9.2",
            name: "Userinfo bypass",
            class: "SSRF & Domain Bypass",
            payload: json!({
                "tool": "http", "function": "request",
                "parameters": {"url": "http://allowed.com@169.254.169.254/path"}
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A9.3",
            name: "Percent-encoded userinfo bypass",
            class: "SSRF & Domain Bypass",
            payload: json!({
                "tool": "http", "function": "request",
                "parameters": {"url": "http://allowed%2Ecom%40169.254.169.254@evil.com/"}
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A9.4",
            name: "Trailing dot bypass",
            class: "SSRF & Domain Bypass",
            payload: json!({
                "tool": "http", "function": "request",
                "parameters": {"url": "https://evil.com./path"}
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A9.5",
            name: "IPv6 loopback",
            class: "SSRF & Domain Bypass",
            payload: json!({
                "tool": "http", "function": "request",
                "parameters": {"url": "http://[::1]/admin"}
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A9.6",
            name: "Port smuggling",
            class: "SSRF & Domain Bypass",
            payload: json!({
                "tool": "http", "function": "request",
                "parameters": {"url": "https://evil.com:8080/exfiltrate"}
            }),
            check_fn: is_deny,
        },
    ]
}