SentriX — AI Security Assessment

Secret-like material was observed in the server's response data during scanning: AWS Access Key in get_proxy_http_history

AWS Access Key in get_proxy_http_history

The MCP endpoint accepted a full session (initialize + tools/list) with no authentication token. Any client that can reach this endpoint can discover and invoke every exposed tool.

tools/list returned 14 tool(s) with no credentials

The server exposes 1 tool(s) that can issue arbitrary HTTP requests from the MCP host (SSRF-class). An unauthenticated attacker who can reach this endpoint could pivot into internal networks, hit cloud metadata endpoints, or drive traffic through the host.

send_webhook(targetHost(str), targetPort(integer), https=boolean, content(str))

A read-only probe successfully retrieved data from the server without any credentials.

Captured entries:
1) /admin/users ticket #4021 body: <img src=x onerror=alert(1)>
   {content: '<script>exfil(document.cookie)</script>'}
2) POST /v1/orders [202] Authorization: <redacted>
3) s3 acme-prod-backup dump: AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE rows:[{"ssn":"123-45-6789"}]
4) git push gi

sentrix-probe

sentrix-probe

c2VudHJpeC1wcm9iZQ==

����,i���

5qgbw7tz

The server exposes 3 tool(s) that change host application state (configuration, interception, execution control). Unauthorized calls can disrupt, reconfigure or disable the host application.

update_user_profile(userId(str), field(str), value(str)); delete_user_record(userId(str), reason=str); create_alert_rule(name(str), condition(str))

1 tool description(s) contain wording that reads like instructions to an AI agent (e.g. 'ignore previous instructions', 'exfiltrate', 'system prompt'). Such descriptions are an injection vector: if an LLM agent consumes this MCP server, the tool metadata itself becomes attacker-controlled prompt input.

get_customer_record ((?i)system prompt)

The server exposes enumerable resources and/or prompts in addition to tools. These can reveal internal URIs, data sources and workflow metadata an attacker could target.

demo://internal/credentials (Internal service credentials); demo://config/secrets (Deployment secrets)

company-onboarding; internal-debug

The server advertises the 'sampling' capability, meaning it can ask the client (an LLM agent) to generate content. A compromised or malicious server can abuse this to prompt-inject the client's LLM, exfiltrate conversation context, or influence the agent's actions.

server capability 'sampling' is enabled

Tool outputs reflect HTML/script constructs. If an LLM agent renders tool output, this is output-injection (agent poisoning): malicious content in a data source could execute when displayed or influence the model.

Captured entries:
1) /admin/users ticket #4021 body: <img src=x onerror=alert(1)>
   {content: '<script>exfil(document.cookie)</script>'}
2) POST /v1/orders [202] Authorization: <redacted>
3) s3 acme-

The MCP endpoint responds with a permissive CORS policy (Access-Control-Allow-Origin: *). A malicious web page visited by a user with a valid MCP session could drive the MCP server from the browser, invoking tools with the victim's privileges.

Access-Control-Allow-Origin: *

The MCP endpoint is served over HTTP without TLS. Tool results — which may include proxy history, tokens and credentials — can be read or tampered with by anyone able to observe the connection.

http://127.0.0.1:8142 (no TLS)

The server accepted an initialize handshake with the older '2024-11-05' protocol version. Old versions may lack security extensions (auth, sampling policies) present in newer drafts.

initialize with protocolVersion=2024-11-05 accepted

5 tool(s) accepted unknown parameters or obviously wrong-typed values instead of rejecting them. Weak input validation can allow parameter smuggling into backend handlers.

accepted unknown param and wrong-typed value

accepted unknown param and wrong-typed value

accepted unknown param and wrong-typed value

accepted unknown param and wrong-typed value

accepted unknown param and wrong-typed value

The endpoint accepted a session and tool enumeration with no rate limiting or per-tool authorization observed. Repeated tool calls are possible without restriction.

no rate-limit headers or per-tool auth observed