X-Ray Your Agents — Pentesting MCPs, Skills, and the Plugin Supply Chain

  • Post author:
  • Post category:Uncategorized

Speakers: Xia Hua (co-founder/CEO, Traceforce), Abhijeet Kumar (OSCP, UMD CTF captain) · GitHub: mcp-xray

📄 Download this note as Markdown

Overview

Agents now run with thousands of third-party plugins — MCP servers, Claude skills, GPT actions, IDE extensions — and the prevailing trust model is roughly “read the README and hope.” Tool descriptions are executable prompts, tool parameters are executable code paths, and tool outputs feed straight into the next agent step, yet there’s no npm-audit equivalent for this ecosystem, no signed manifests, and no capability sandbox in the wild. MCP X-Ray is an open-source security scanner that ports classical pentest tradecraft to the agent plugin supply chain: static config and repo audit, rules-based and LLM-driven semantic analysis, and active pentesting that actually invokes tools with adversarial inputs — emitting SARIF that drops into GitHub, VS Code, and CI gates today.

Notes

Attack Examples

  • Tool poisoning — an MCP might be poisoned in files beyond its description
  • Parameter injection — instructions might include parameters the agent doesn’t validate

mcp-xray Modes

  • config-scan — scan MCP configs for security issues; run before pentest to baseline your setup
  • pentest — execute security test plans by making actual tool calls against MCP servers (LLM required); run before production deployment
  • repo-scan — scan the codebase for vulnerabilities when you own or can change the code
  • Recommended to run all three in sequence

Runs as a CLI tool, outputs SARIF format. Demoed against an OAuth MCP server.

From the Repo

Findings can also be uploaded to Traceforce Atlas, a registry covering 600+ MCPs. Two analysis methods: token-based pattern matching (default, offline) and LLM-based semantic analysis, supporting Claude, OpenAI, and AWS Bedrock. repo-scan combines software composition analysis with static/taint analysis via OpenGrep and CodeQL for cross-file vulnerability tracking. Requires Go 1.25.4+; build with make install-dependencies && make all.

Filed Under: #defcon34

Tags: