Runtime probe for MCP cross-tenant response leaking via JSON-RPC id collision (CVE-2026-111770)
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-idprobe","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# mcp-idprobe A runtime probe for **MCP cross-tenant response leaking via JSON-RPC id collision** — [CVE-2026-111770](https://dev.to) (`@modelcontextprotocol/server` 2.0.0–2.2.0, fixed in 2.3.0). Stdlib-only Python, no dependencies. ## The bug, in one paragraph The MCP TypeScript SDK numbers each client's JSON-RPC requests from 0. In the affected versions, when several clients share one transport / `McpServer` instance over HTTP (exactly what the official README's hono/express/fastify/node adapter examples did), the server tracks in-flight requests by the **bare request id**. Two clients both have a request `"0"` in flight; when results complete, the lookup by bare id hands one client's tool result to the other client. No attacker is needed — ordinary overlapping traffic leaks across tenants. ## What this tool does Against a **running** MCP server over Streamable HTTP, `mcp-idprobe`: 1. Opens **two independent client sessions** (`initialize` → `notifications/initialized`). 2. **Interleaves** `tools/call` requests from both clients, each client numbering its own requests from `"0"` — mirroring the per-client counters from the CVE. 3. Every request carries a **per-client secret token** in its arguments. 4. Collects each session's responses and attributes them by secret. If any client receives the other client's secret → **`VULNERABLE`**, with the crossed response saved as evidence. Otherwise → **`PASS`**. It also ships a **heuristic static scan** of server source (`.ts`/`.js`/`.py`, plus `package.json` SDK version) for the anti-pattern behind the CVE: a module-scope `new McpServer(...)` / `StreamableHTTPServerTransport` reused across HTTP handlers, and pending-request tables keyed by bare id with no session scoping. Output is a machine-readable `evidence.json` plus a human `summary.txt`. ## Differentiation: mcp-idprobe vs mcp-audit My [`mcp-audit`](https://github.com/hahahahahahahahah6/mcp-audit) repo is a **local static attack-surface scanner**: it reads c…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.