MCP Validator Cci

🛡️ MCP Server Security Testing Suite

Complete automated security testing for MCP (Model Context Protocol) servers with beautiful reporting and transparent scoring.

🚀 Quick Start

# Install dependencies
pip3 install requests

# List available servers
python3 mcp_validator.py --list

# Test single server
python3 mcp_validator.py --server canva_mcp_server --verbose

# Test all servers
python3 mcp_validator.py --all --verbose

Output: Beautiful security reports with scores, visual progress bars, and actionable recommendations!

📊 What You Get

Protocol Version Detection

The validator automatically detects and displays:

• 📋 MCP Protocol Version - e.g., "2024-11-05"
• 🖥️ Server Information - Server name and version
• ⚙️ Server Capabilities - Tools, resources, prompts support

This information is extracted from the MCP initialization handshake and included in reports.

Beautiful Security Reports

======================================================================
🛡️  MCP SERVER SECURITY VALIDATOR
======================================================================
Server: canva_mcp_server
URL: https://mcp.canva.com/mcp
Testing: Server-side security controls
======================================================================

📋 MCP Protocol Version: 2024-11-05
🖥️  Server: canva-mcp-server v1.0.0
⚙️  Capabilities: tools, resources

...tests run...

======================================================================
📊 FINAL SECURITY ASSESSMENT
======================================================================

Server: canva_mcp_server
URL: https://mcp.canva.com/mcp
MCP Protocol: 2024-11-05
Server Info: canva-mcp-server v1.0.0
Rating: 🟢 GOOD
Score: 67.9/100

[█████████████████████████████████░░░░░░░░░░░░░░░░░] 67.9%

──────────────────────────────────────────────────────────────────────
📋 SCORE BREAKDOWN (Each test weighted equally)
──────────────────────────────────────────────────────────────────────

Test                                Severity     Score      Visual
─────────────────────────────────── ──────────── ────────── ────────────
Authentication Enforcement          🟡 MEDIUM     50/100   [█████░░░░░]
Https Enforcement                   ✅ LOW       100/100   [██████████]
Http Method Enforcement             ✅ LOW       100/100   [██████████]
Rate Limiting Enforcement           🔴 HIGH       25/100   [██░░░░░░░░]
Tls Configuration                   ✅ LOW       100/100   [██████████]
Security Headers                    🟡 MEDIUM     50/100   [█████░░░░░]
Error Handling                      🟡 MEDIUM     50/100   [█████░░░░░]
──────────────────────────────────────────────────────────────────────
Total                                            475/700   Average: 67.9
──────────────────────────────────────────────────────────────────────

🚨 ISSUE SUMMARY
──────────────────────────────────────────────────────────────────────
🔴 HIGH Issues: 1      ← Fix before production deployment
🟡 MEDIUM Issues: 3    ← Should be addressed

💡 KEY RECOMMENDATIONS
──────────────────────────────────────────────────────────────────────
1. 🔴 Implement rate limiting: Prevent DoS attacks
2. 🟡 Complete security headers: Add missing headers
3. 🟡 Improve error handling: Avoid information disclosure

🎯 Features

✅ 7 Critical Security Tests

1. 🔐 Authentication Enforcement

- Tests if server rejects anonymous requests - Validates invalid token rejection - Tests valid token acceptance (when available)

1. 🔒 HTTPS Enforcement

- Checks if server uses HTTPS - Tests HTTP to HTTPS redirection - Validates TLS configuration

1. 🚫 HTTP Method Enforcement (CSRF Protection)

- Ensures POST is required for tool invocation - Tests if GET requests are rejected - Validates CSRF prevention

1. ⏱️ Rate Limiting (DoS Protection)

- Tests if server throttles rapid requests - Checks for 429 (Too Many Requests) responses - Validates DoS protection

1. 🔐 TLS Configuration

- Validates TLS version (1.2+) - Checks cipher suite strength - Tests certificate validity

1. 🛡️ Security Headers

- Strict-Transport-Security (HSTS) - X-Content-Type-Options - X-Frame-Options - Content-Security-Policy - X-XSS-Protection

1. 🐛 Error Handling

- Tests for information disclosure - Checks for stack trace leakage - Validates generic error messages

✅ Enhanced Reporting Features

• 📊 Visual Progress Bars - See scores at a glance
• 📋 Detailed Score Breakdown - Understand each test's contribution
• 🎨 Color-Coded Severity - Quick issue identification (🟢🟡🟠🔴⚫)
• 🚨 Issue Summary - Prioritized by severity
• 💡 Actionable Recommendations - Know what to fix first
• 📈 Transparent Scoring - See exactly how scores are calculated

📈 How Scoring Works

Severity to Score Mapping

Severity Levels:
├─ LOW (✅)      = 100 points (good security posture)
├─ MEDIUM (🟡)   =  50 points (moderate concern)
├─ HIGH (🔴)     =  25 points (serious vulnerability)
└─ CRITICAL (⚫) =   0 points (immediate risk)

Final Score = Average of all 7 test scores

Example Calculation

Test 1: Authentication      MEDIUM (50 pts) 🟡
Test 2: HTTPS              LOW (100 pts)    ✅
Test 3: Method Enforcement LOW (100 pts)    ✅
Test 4: Rate Limiting      HIGH (25 pts)    🔴
Test 5: TLS Configuration  LOW (100 pts)    ✅
Test 6: Security Headers   MEDIUM (50)      🟡
Test 7: Error Handling     MEDIUM (50)      🟡
                          ─────────
Total: 475 points out of 700 possible

Score = 475 / 7 = 67.9/100 → 🟢 GOOD

Rating Scale

Why These Scores?

• Each HIGH issue drops score by ~30 points (no rate limiting)
• CRITICAL issues drop score by ~43 points (no HTTPS, no auth)
• MEDIUM issues drop score by ~14 points (missing headers)
• Fix HIGH/CRITICAL issues first for maximum impact!

💻 Usage Examples

Test Single Server (Detailed Report)

python3 mcp_validator.py --server canva_mcp_server --verbose

Output:

• Complete test execution logs
• Visual progress bars
• Detailed score breakdown
• Issue summary
• Actionable recommendations

Test Single Server (Summary Only)

python3 mcp_validator.py --server canva_mcp_server

Output:

🟢 Server Security Rating: GOOD
📊 Security Score: 67.9/100
📄 Report saved: reports/canva_mcp_server_security_report.json

Test All Servers

python3 mcp_validator.py --all --verbose

Output:

• Detailed reports for all servers
• Individual JSON reports
• Combined summary report
• Overall statistics

List Available Servers

python3 mcp_validator.py --list

Use Custom Configuration

python3 mcp_validator.py --config my_servers.json --all --verbose

📁 Configuration

The validator uses JSON configuration files to define MCP servers.

Default Configuration (mcp_clean.json)

{
  "mcpServers": {
    "canva_mcp_server": {
      "type": "https",
      "url": "https://mcp.canva.com/mcp",
      "description": "Canva MCP server",
      "headers": {
        "Authorization": "Bearer ${CANVA_TOKEN}"
      }
    },
    "local_server": {
      "type": "http",
      "url": "http://localhost:8000",
      "description": "Local development server"
    }
  }
}

Configuration Fields

• type: Transport protocol (http, https)
• url: Server endpoint URL
• description: Human-readable server description
• headers (optional): Custom headers (e.g., authentication)

Adding Your Own Servers

1. Edit mcp_clean.json
2. Add your server configuration
3. Run: python3 mcp_validator.py --list to verify

Environment Variables for Tokens

# Set authentication tokens via environment
export CANVA_TOKEN="your_token_here"
export MY_SERVER_TOKEN="another_token"

# Tokens are automatically substituted in config
python3 mcp_validator.py --server canva_mcp_server --verbose

🔧 Installation

Prerequisites

• Python 3.7+
• pip3

Install Dependencies

pip3 install requests

That's it! No other dependencies required.

📊 Report Outputs

Console Output (--verbose)

Beautiful, colored terminal output with:

• Real-time test execution logs
• Visual progress bars
• Detailed findings for each test
• Score breakdown table
• Issue summary
• Prioritized recommendations

JSON Reports

Saved to reports/ directory:

Individual Reports:

reports/
├── canva_mcp_server_security_report.json
├── notion_mcp_server_security_report.json
├── linear_mcp_server_security_report.json
└── ...

Combined Report:

reports/all_servers_security_report.json

JSON Structure:

{
  "server_name": "canva_mcp_server",
  "timestamp": "2025-11-03T12:00:00Z",
  "url": "https://mcp.canva.com/mcp",
  "protocol_version": "2024-11-05",
  "server_info": {
    "name": "canva-mcp-server",
    "version": "1.0.0"
  },
  "overall_security_score": 67.9,
  "security_rating": "GOOD",
  "score_breakdown": [
    {
      "test": "authentication_enforcement",
      "severity": "MEDIUM",
      "score": 50
    }
  ],
  "tests": {
    "authentication_enforcement": {
      "severity": "MEDIUM",
      "findings": ["✅ PASS: Anonymous access rejected"]
    }
  }
}

🎯 Common Use Cases

CI/CD Integration

#!/bin/bash
# ci-security-test.sh

# Run security tests
python3 mcp_validator.py --server production_server

# Check score threshold
SCORE=$(cat reports/production_server_security_report.json | jq '.overall_security_score')

if (( $(echo "$SCORE  before.txt

# Apply security improvements...

# After fixes
python3 mcp_validator.py --server my_server --verbose > after.txt

# Compare
diff before.txt after.txt

🚨 Common Security Issues & Fixes

Issue 1: No Rate Limiting (25 points)

Finding:

🔴 HIGH: No rate limiting detected (50 requests in 2s)

Problem: Server vulnerable to DoS attacks - no request throttling.

Fix:

from flask_limiter import Limiter

limiter = Limiter(
    app,
    default_limits=["100 per minute", "1000 per hour"]
)

@app.route('/mcp')
@limiter.limit("100 per minute")
def mcp_endpoint():
    # Your code

Impact: +30 points (HIGH → LOW)

Issue 2: Missing Security Headers (25-50 points)

Finding:

🔴 HIGH: Only 1/5 security headers present

Problem: Missing critical security headers expose users to attacks.

Fix:

@app.after_request
def add_security_headers(response):
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    response.headers['X-XSS-Protection'] = '1; mode=block'
    return response

Impact: +25-50 points (HIGH/MEDIUM → LOW)

Issue 3: No HTTPS (0 points)

Finding:

⚫ CRITICAL: Server uses unencrypted HTTP

Problem: All data transmitted in plaintext.

Fix:

# Redirect HTTP to HTTPS
@app.before_request
def redirect_to_https():
    if request.url.startswith('http://'):
        return redirect(request.url.replace('http://', 'https://'), code=301)

# Or configure your web server (nginx)
server {
    listen 80;
    return 301 https://$host$request_uri;
}

Impact: +43 points (CRITICAL → LOW)

🔍 Troubleshooting

Issue: "Certificate verification failed"

Finding:

🔴 HIGH: Certificate verification failed

Causes:

• Self-signed certificate in development
• Missing CA certificate in system
• Test environment configuration

Solutions:

1. Production: Use valid certificate from Let's Encrypt or commercial CA

1. Check if it's a local environment issue:

   python3 -c "import requests; requests.get('https://your-server.com')"

Issue: "Connection timeout"

Problem: Tests hang or timeout

Solutions:

1. Check if server is running:

   curl http://localhost:8000

1. Check firewall:

   # Allow connections
   sudo ufw allow 8000

Issue: "404 Not Found"

Problem: Server returns 404 for all endpoints

Causes:

• Server not running
• Wrong URL in configuration
• Different endpoint paths

Solutions:

1. Verify server is running:

   curl -v https://mcp.canva.com/mcp

1. Check configuration:

   {
     "url": "https://mcp.canva.com/mcp"  // Ensure correct URL
   }

📚 Project Structure

.
├── mcp_validator.py            # Main validator script
├── mcp_validator_lib.py        # Core validator logic
├── mcp_clean.json              # Server configuration
├── requirements.txt            # Python dependencies
├── reports/                    # Test reports output
│   ├── *_security_report.json  # Individual reports
│   └── all_servers_security_report.json  # Combined report
├── archive_docs/               # Archived documentation
└── README.md                   # This file

🎓 Understanding the Tests

Test 1: Authentication Enforcement

What we test:

1. Send request with NO credentials
   → Server should return 401 Unauthorized

2. Send request with INVALID token
   → Server should return 401 Unauthorized

3. Send request with VALID token (if available)
   → Server should return 200 OK

Scoring:

• All pass = LOW (100 pts)
• Some fail = MEDIUM (50 pts)
• Invalid tokens accepted = HIGH (25 pts)
• No auth at all = CRITICAL (0 pts)

Test 2: HTTPS Enforcement

What we test:

1. Check if server URL uses HTTPS
   
2. Send HTTP request
   → Server should redirect (301) or reject (403)

3. Validate TLS configuration

Scoring:

• HTTPS + redirect = LOW (100 pts)
• HTTPS but no redirect = MEDIUM (50 pts)
• HTTP allowed = HIGH (25 pts)
• Only HTTP = CRITICAL (0 pts)

Test 3: HTTP Method Enforcement (CSRF)

What we test:

1. Send POST to /tools/call
   → Should accept (or 401 if auth required)

2. Send GET to /tools/call
   → Should reject with 405 Method Not Allowed
   → Or require authentication (401/403)

3. Test with query parameters
   → GET /tools/call?tool=test should fail

Scoring:

• GET rejected or auth-protected = LOW (100 pts)
• Unclear behavior = MEDIUM (50 pts)
• GET accepted without auth = CRITICAL (0 pts)

Test 4: Rate Limiting

What we test:

1. Send 50 rapid requests (as fast as possible)

2. Check for 429 (Too Many Requests) response

3. Measure request rate

Scoring:

• 429 returned = LOW (100 pts)
• No limiting = HIGH (25 pts)

Test 5: TLS Configuration

What we test:

1. Attempt TLS connection

2. Validate certificate

3. Check TLS version (should be 1.2 or 1.3)

Scoring:

• Valid cert + TLS 1.2+ = LOW (100 pts)
• Cert warnings = MEDIUM (50 pts)
• Cert failed = HIGH (25 pts)

Test 6: Security Headers

What we test:

Check for these 5 headers:
1. Strict-Transport-Security (HSTS)
2. X-Content-Type-Options
3. X-Frame-Options
4. Content-Security-Policy
5. X-XSS-Protection

Scoring:

• 5/5 present = LOW (100 pts)
• 3-4 present = MEDIUM (50 pts)
• 1-2 present = HIGH (25 pts)
• 0 present = CRITICAL (0 pts)

Test 7: Error Handling

What we test:

Send malformed requests:
- Invalid JSON
- SQL injection attempt
- Path traversal
- XSS attempt
- Command injection

Check for information disclosure:
- Stack traces
- File paths
- Line numbers
- Exception details

Scoring:

• No disclosure = LOW (100 pts)
• Minor disclosure = MEDIUM (50 pts)
• Stack traces leaked = HIGH (25 pts)

🏆 Best Practices

For Developers

1. Run tests early and often

   # Before committing
   python3 mcp_validator.py --server my_server

1. Fix CRITICAL and HIGH issues first

- They have the biggest impact on score - They represent real security risks

1. Aim for 60+ score before production

- 60+ = GOOD rating - Demonstrates basic security hygiene

1. Use --verbose to understand failures

   python3 mcp_validator.py --server my_server --verbose

For Security Teams

1. Set minimum score thresholds

   # In CI/CD pipeline
   if score < 60: fail_build()

1. Regular security audits

   # Weekly or monthly
   python3 mcp_validator.py --all --verbose

1. Track improvements over time

- Compare reports from different dates - Monitor score trends

1. Focus on common patterns

- Rate limiting often missing - Security headers frequently incomplete - Authentication issues common

For Management

1. Security score = risk indicator

- <40: Don't deploy to production - 40-59: Deploy with monitoring - 60-79: Production acceptable - 80+: Excellent security posture

1. Use reports in security reviews

- Visual progress bars for presentations - JSON reports for data analysis - Trends over time for metrics

1. Prioritize by severity

- ⚫ CRITICAL: Immediate action - 🔴 HIGH: This sprint - 🟡 MEDIUM: Next sprint - ✅ LOW: Maintain

📊 Real-World Results

From testing 10 production MCP servers:

Common Findings:

• 9/10 servers: Missing rate limiting
• 8/10 servers: Incomplete security headers
• Average Score: 53.9/100 (FAIR) → After fixes: 67.9/100 (GOOD)

Best Performer: Sentry (71.43/100 - GOOD)

• ✅ Good HTTPS enforcement
• ✅ 4/5 security headers
• ✅ Strong authentication
• ❌ No rate limiting

Key Takeaway: Even well-known production services have security gaps that can be improved! 🚨

❓ FAQ

Q: What is MCP protocol version detection? A: The validator sends an MCP initialization request to detect:

• Protocol Version: Which MCP protocol version the server implements (e.g., "2024-11-05")
• Server Information: Server name and version
• Capabilities: What features the server supports (tools, resources, prompts)

Q: Does this test replace penetration testing? A: No, this is automated security validation. Professional penetration testing is still recommended for production systems.

Q: Will this test harm my server? A: No, all tests are non-destructive. We test server responses without attempting actual exploits.

Q: Can I use this in CI/CD? A: Yes! Check exit codes and JSON reports for automated validation.

Q: How do I improve my score? A: Focus on HIGH and CRITICAL issues first (biggest impact). Common fixes:

1. Implement rate limiting
2. Add all 5 security headers
3. Enforce HTTPS
4. Require authentication

Q: Is 60/100 a passing score? A: For production, aim for 60+ (GOOD). For high-security applications, aim for 80+ (EXCELLENT).

🤝 Contributing

Reporting Issues

Found a bug or false positive? Please report:

1. Server configuration (sanitized)
2. Command used
3. Expected vs actual behavior
4. Full error output

Adding New Tests

To add a new security test, edit mcp_validator_lib.py:

def test_my_security_check(self):
    """TEST 8: My Security Check"""
    print("\n🔒 TEST 8: My Security Check")
    print("-" * 70)
    
    findings = []
    severity = 'LOW'
    
    # Your test logic here
    # Set severity based on findings
    
    self.results['tests']['my_security_check'] = {
        'severity': severity,
        'findings': findings
    }

📞 Support

• Issues: Create an issue with detailed information
• Questions: Check FAQ above or create a discussion
• Security Concerns: Report privately if you find vulnerabilities in the tool itself

📝 License

This project is provided as-is for security testing purposes. Use responsibly and only on servers you own or have permission to test.

🎉 Summary

This tool gives you:

1. ✅ Automated security testing for MCP servers
2. ✅ Beautiful, actionable reports with visual indicators
3. ✅ Transparent scoring - understand exactly how it's calculated
4. ✅ 7 critical security tests covering the most important vulnerabilities
5. ✅ JSON reports for automation and tracking
6. ✅ Prioritized recommendations to guide your security improvements

Start testing now:

python3 mcp_validator.py --list
python3 mcp_validator.py --server your_server --verbose

Your security journey starts here! 🚀🛡️