VIPER-MCP: Detecting Vulnerabilities in MCP Servers

What it is

VIPER-MCP is a two-phase auditing pipeline from Zhejiang University and collaborators (arXiv 2605.21392) for MCP servers written in JavaScript/TypeScript and Python. It covers three taint classes: command injection (CWE-78), SSRF (CWE-918) and path traversal (CWE-22). The authors release the code as an anonymous artifact at https://anonymous.4open.science/r/Viper-EA4D.

How it works

Phase I runs static taint analysis twice. Pass 1 treats MCP tool handler parameters as taint sources and runs one reachability query per vulnerability class, with class-specific sanitizer models (shell escaping, URL validation, path canonicalization). Pass 1 alerts only give file-level locations. Pass 2 runs anchor queries that resolve each alert to its enclosing tool handler and re-confirm the flow. The output is a vulnerability-anchored call chain plus a set of oracle rules, which are the sink functions to watch at runtime.

Phase II builds a taint context for each chain from the call chain, the live tool schema and code snippets. An LLM generates varied seed prompts, which are scored and placed in a seed pool. A loop then repeats:

flowchart LR
    A[Seed scheduler picks high-fitness prompt] --> B[Dual mutator: tool-selection or parameter depth]
    B --> C[Proxy agent runs prompt on instrumented server]
    C --> D{Sink fired?}
    D -- feedback and fitness --> A
    D -- yes --> E[Exploitability validator]
    E --> F[PoC prompt reported]

One mutator corrects tool-selection drift and the other pushes the payload deeper through validators and branches.

The worked example is bytebot (11k GitHub stars, 16 MCP tools in a Docker container). The computer_write_file handler interpolates the user-supplied path into sudo-prefixed shell commands run via exec, with no escaping. A prompt carrying test/"; sudo bash -c '...' closes the quoted path and opens a root reverse shell inside the container. The assigned CVE id is redacted in the fetched text.

Preconditions / Affected

The attacker only needs to influence text the agent processes, either a direct prompt or content the agent is told to handle. The attacker does not call the server or tamper with transport. Targets are open-source servers in JS/TS or Python.

What to do

• Server authors: treat every tool argument as untrusted, whatever the schema says. The paper notes MCP does not enforce semantic preconditions and leaves safe argument construction to the agent.
• Auditors: the paper reports 106 confirmed 0-days and 67 CVEs across 39,884 repositories, so the artifact may be worth running against servers you deploy.
• Compare against baselines: the paper reports 0% FPR versus 24.6% to 43.1%, and 7.7% FNR versus 63.8% to 73.1%. Ablations show that removing anchor queries or prompt evolution substantially degrades results.

Caveats

• Tools designed to run privileged operations, such as a shell-execution tool, are excluded as expected behavior.
• Authentication, deployment configuration, protocol glue and non-tool modules are out of scope.
• The authors note the agent's safety behavior can rewrite overtly malicious arguments, so confirmed exploits depend on the LLM used as the proxy agent.
• The fetched text ends partway through Phase I. The evaluation details, the exact model used, runtime figures and the full false-negative methodology were not available to check.