mcpsec 1.1.0

MCP Security Benchmark Framework — vendor-neutral security evaluation for MCP gateways
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

// Copyright 2026 Paolo Vella
// SPDX-License-Identifier: Apache-2.0
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0

//! A5: Confused Deputy — 5 tests
//!
//! Tests default-deny enforcement, priority-based evaluation,
//! deny-override semantics, self-approval prevention, and forbidden parameters.

use super::{is_deny, AttackTest};
use serde_json::json;

pub fn tests() -> Vec<AttackTest> {
    vec![
        AttackTest {
            id: "A5.1",
            name: "Default-deny enforcement",
            class: "Confused Deputy",
            payload: json!({
                "tool": "unknown_tool", "function": "unknown_func",
                "parameters": {}
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A5.2",
            name: "Priority-based escalation attempt",
            class: "Confused Deputy",
            payload: json!({
                "tool": "bash", "function": "exec",
                "parameters": {"command": "whoami"},
                "_test_policies": [
                    {"pattern": "bash:exec", "verdict": "Deny", "priority": 100},
                    {"pattern": "bash:exec", "verdict": "Allow", "priority": 10}
                ]
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A5.3",
            name: "Equal-priority deny override",
            class: "Confused Deputy",
            payload: json!({
                "tool": "bash", "function": "exec",
                "parameters": {"command": "whoami"},
                "_test_policies": [
                    {"pattern": "bash:exec", "verdict": "Allow", "priority": 50},
                    {"pattern": "bash:exec", "verdict": "Deny", "priority": 50}
                ]
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A5.4",
            name: "Self-approval prevention",
            class: "Confused Deputy",
            payload: json!({
                "tool": "vellaveto", "function": "self_approval_check",
                "parameters": {
                    "requester": "bearer:abc123def456",
                    "approver": "bearer:abc123def456",
                    "action": "delete_database"
                }
            }),
            check_fn: is_deny,
        },
        AttackTest {
            id: "A5.5",
            name: "Forbidden parameter escalation",
            class: "Confused Deputy",
            payload: json!({
                "tool": "admin", "function": "action",
                "parameters": {"admin": true, "sudo": "root"}
            }),
            check_fn: is_deny,
        },
    ]
}