{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_psujv4tk2t3c","handle":"mcp-idprobe","url":"https://wellknown.network/agents/mcp-idprobe","links":{"self":"https://wellknown.network/agents/mcp-idprobe/record.json","html":"https://wellknown.network/agents/mcp-idprobe","markdown":"https://wellknown.network/agents/mcp-idprobe/record.md","api":"https://wellknown.network/api/v1/agents/mcp-idprobe","status":"https://wellknown.network/api/v1/agents/mcp-idprobe/status","claim":"https://wellknown.network/agents/mcp-idprobe/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/mcp-idprobe/claim.json","badge":"https://wellknown.network/agents/mcp-idprobe/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/mcp-idprobe/history","tools":"https://wellknown.network/api/v1/agents/mcp-idprobe/tools"},"ard":{"identifier":"urn:air::server:mcp-idprobe","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"mcp-idprobe","summary":"Runtime probe for MCP cross-tenant response leaking via JSON-RPC id collision (CVE-2026-111770)","description":"# mcp-idprobe\n\nA runtime probe for **MCP cross-tenant response leaking via JSON-RPC id collision** — [CVE-2026-111770](https://dev.to) (`@modelcontextprotocol/server` 2.0.0–2.2.0, fixed in 2.3.0). Stdlib-only Python, no dependencies.\n\n## The bug, in one paragraph\n\nThe MCP TypeScript SDK numbers each client's JSON-RPC requests from 0. In the affected versions, when several clients share one transport / `McpServer` instance over HTTP (exactly what the official README's hono/express/fastify/node adapter examples did), the server tracks in-flight requests by the **bare request id**. Two clients both have a request `\"0\"` in flight; when results complete, the lookup by bare id hands one client's tool result to the other client. No attacker is needed — ordinary overlapping traffic leaks across tenants.\n\n## What this tool does\n\nAgainst a **running** MCP server over Streamable HTTP, `mcp-idprobe`:\n\n1. Opens **two independent client sessions** (`initialize` → `notifications/initialized`).\n2. **Interleaves** `tools/call` requests from both clients, each client numbering its own requests from `\"0\"` — mirroring the per-client counters from the CVE.\n3. Every request carries a **per-client secret token** in its arguments.\n4. Collects each session's responses and attributes them by secret. If any client receives the other client's secret → **`VULNERABLE`**, with the crossed response saved as evidence. Otherwise → **`PASS`**.\n\nIt also ships a **heuristic static scan** of server source (`.ts`/`.js`/`.py`, plus `package.json` SDK version) for the anti-pattern behind the CVE: a module-scope `new McpServer(...)` / `StreamableHTTPServerTransport` reused across HTTP handlers, and pending-request tables keyed by bare id with no session scoping.\n\nOutput is a machine-readable `evidence.json` plus a human `summary.txt`.\n\n## Differentiation: mcp-idprobe vs mcp-audit\n\nMy [`mcp-audit`](https://github.com/hahahahahahahahah6/mcp-audit) repo is a **local static attack-surface scanner**: it reads c…","publisher":null,"homepage":"https://github.com/hahahahahahahahah6/mcp-idprobe","repository":"https://github.com/hahahahahahahahah6/mcp-idprobe","version":"0.1.0","license":"MIT","protocols":["mcp"],"tags":["mcp","model-context-protocol","security","cve-2026-111770","json-rpc","pentest"],"pricing":null,"endpoints":[{"url":"pypi:mcp-idprobe","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi"}},"derived":{"capabilities":[{"slug":"security.scanning","name":"Security Scanning","confidence":1,"provenance":"declared"},{"slug":"code.security-review","name":"Security Review","confidence":0.936,"provenance":"derived"},{"slug":"dev.package-management","name":"Packages & Dependencies","confidence":0.859,"provenance":"derived"}],"categories":["code","dev","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"mcp-idprobe","registry":"pypi","observedAt":"2026-10-24T17:29:18.154Z","publishedAt":"2026-10-24T08:01:40.259656Z","latestVersion":"0.1.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"mcp-idprobe","url":"https://pypi.org/project/mcp-idprobe/","firstSeenAt":"2026-10-24T17:28:06.797Z","fetchedAt":"2026-10-24T17:28:06.797Z","normalizedAt":"2026-10-24T17:28:06.797Z"}]},"firstSeenAt":"2026-10-24T17:28:06.797Z","updatedAt":"2026-10-24T17:29:18.154Z"}