버전: 1.2.0

MCP-ASD는 모델 Context Protocol (MCP) 서버의 공격 표면을 식별, 맵 및 테스트하도록 설계된 Burp Suite 확장 (Montoya API)입니다.

Burp의 비동기 테스트 도구 (Repeater, Intruder, Scanner)와 MCP 연결 (SSE & WebSockets)의 비동기적 인 성격 사이의 브리지를 제공합니다. 이 보안 전문가는 표준 웹 테스트 워크플로우를 사용하여 MCP 도구, 리소스 및 Prompts를 감사 할 수 있습니다.

특징

• **Multi-Protocol 지원 : ** Server-Sent Events (SSE), WebSockets (ws/wss) 및 HTTP POST 전용 운송 (Get/SSE를 지원하지 않는 서버 용).
• ** Endpoint Auto-Discovery:** MCP 엔드포인트의 자동화된 탐지는 인증이 요구하는 보호된 엔드포인트를 탐지합니다.
• **Attack 표면 처리 : ** 도구, 리소스 및 Prompts를 자동으로 발견하고 시각화합니다.
• **Synchronous Bridging: ** Burp 반복기 및 Intruder의 원활한 사용으로 비동기 ID 상관 관계 및 세션 관리 처리.
• ** 프로토 타입 생성 : ** 자동으로 발견 된 도구 스키마에 따라 유효 JSON-RPC 페이로드를 생성합니다.

MCP Attack Surface Detector (MCP-ASD)

Version: 1.2.0

MCP-ASD is a Burp Suite extension (Montoya API) designed to identify, map, and test the attack surface of Model Context Protocol (MCP) servers.

It provides a bridge between Burp’s synchronous testing tools (Repeater, Intruder, Scanner) and the asynchronous, persistent nature of MCP connections (SSE & WebSockets). This allows security professionals to audit MCP Tools, Resources, and Prompts using standard web testing workflows.

Features

• Multi-Protocol Support: Full support for Server-Sent Events (SSE), WebSockets (ws/wss), and HTTP POST-only transport (for servers that don’t support GET/SSE).
• Endpoint Auto-Discovery: Automated detection of MCP endpoints, including detection of protected endpoints that require authentication.
• Attack Surface Enumeration: Automatically discovers and visualizes Tools, Resources, and Prompts, including schema extraction for arguments.
• Synchronous Bridging: Enables seamless use of Burp Repeater and Intruder by handling asynchronous ID correlation and session management.
• Prototype Generation: Automatically generates valid JSON-RPC payloads based on discovered tool schemas.
• Authentication & mTLS: Support for custom HTTP headers (OAuth Bearer tokens, API keys) and mTLS client certificates (PKCS#12).
• Native Integration: Reports discovered MCP servers directly to Burp’s Target and Dashboard.
• Advanced Detection: Includes passive monitoring and active probing for MCP servers on discovered domains.
• Auth Gateway Detection: Detects MCP endpoints behind authentication gateways (Zscaler, OAuth, SAML, SSO) by recognizing redirect patterns to auth endpoints, including URL-encoded origurl parameters.

Installation

Prerequisites

• Java JDK 21+ (to build)
• Burp Suite Professional or Community (2025.6+)
  • MCP server detection (passive and active checks) runs through Burp Scanner and requires Burp Suite Professional. Everything else works in Community.

Building from Source

Note: There is a precompiled .jar at:
https://github.com/hoodoer/MCP-ASD/releases/tag/v1.0

git clone https://github.com/your-repo/mcp-asd.git
cd mcp-asd
./gradlew shadowJar

The resulting JAR will be located at build/libs/mcp-asd.jar.

Loading the Extension

1. Open Burp Suite.
2. Navigate to Extensions -> Installed.
3. Click Add.
4. Select Java and browse to the generated mcp-asd.jar.

Usage

1. Connection Management

• Use the New Connection button in the MCP-ASD tab to connect to a server.
• The Auto-Detect Endpoints feature identifies common MCP paths.
• Connection settings (host, port, headers, certificates) are persisted for the duration of the session.
• Cancel Button: If a connection attempt hangs or takes too long, use the Cancel button to abort the handshake and reset the interface.