MCP Server Fuzzer

Black-box security assessment for live Model Context Protocol servers. It drives an authorized target over its real transport, sends realistic and malformed input, classifies the responses, and writes findings and reproduction data to disk.

Documentation | Assessment workflow | CLI reference | Releases

Authorization

Use this tool only against MCP servers you own or are explicitly authorized to test. It sends attack-pattern input, can start local processes, and with --auth-audit-intrusive will register OAuth clients on the target's authorization server. The built-in safety controls reduce accidental impact; they are not a substitute for a container, a VM, or an engagement-specific network boundary. --security-audit-intrusive sends a foreign-Origin probe to test DNS-rebinding defenses and requires the same explicit authorization.

What it does

The fuzzer connects over stdio, HTTP, SSE, or Streamable HTTP and answers a fixed set of assessment questions:

• What tools, resources, prompts, and protocol methods does the server expose?
• Does it reject malformed and out-of-contract input, or accept it?
• Do tool descriptions or schemas carry poisoning markers, hidden instructions, duplicate definitions, typosquatted names, or dangerous capability combinations?
• Does an advertised OAuth boundary publish unsafe metadata or serve tools without the expected authentication?
• What does a local stdio server execute, read, write, or connect to while the test runs?

Install

Requires Python 3.10 or newer.

python -m pip install mcp-fuzzer
mcp-fuzzer --version

Optional runtime observation of local stdio processes:

python -m pip install "mcp-fuzzer[mcpfz-probe]"

Docker image (princekrroshan01/mcp-fuzzer):

docker pull princekrroshan01/mcp-fuzzer:latest
docker run --rm princekrroshan01/mcp-fuzzer:latest --help

Run an assessment

Against a remote HTTP or Streamable HTTP target:

mcp-fuzzer \
  --mode tools \
  --protocol streamablehttp \
  --endpoint https://target.example.com/mcp \
  --phase realistic \
  --runs 10 \
  --security-audit \
  --seed 42 \
  --output-dir reports/baseline

Against a local stdio target, confine file operations and deny non-local network access:

mcp-fuzzer \
  --mode all \
  --protocol stdio \
  --endpoint "python my_server.py" \
  --enable-safety-system \
  --fs-root "$PWD/fuzz-sandbox" \
  --no-network \
  --runs 5 \
  --seed 42 \
  --output-dir reports/baseline

To try the tool without a target, use the bundled fixtures in examples/.

Start with low run counts, bounded timeouts, dedicated credentials, and an isolated target. The assessment workflow describes what to record at each stage.

What it produces

Every session writes to --output-dir (default reports/):