new active script to detect open mcp servers #499
Conversation
|
Great job! No new security vulnerabilities introduced in this pull requestUse @Checkmarx to reach out to us for assistance. Just send a PR comment with Examples: |
|
@bananabr thanks for this PR! Am I right in thinking that the paths you're checking should be absolute, ie Do you have any links to example MCP servers which this rule detects so we can test it? The build is failing, but it looks like you can fix that with |
|
The file name and code link don't match. They should also follow the naming guidance: https://github.com/zaproxy/community-scripts/blob/main/CONTRIBUTING.md#naming-scripts |
|
|
||
| function getMetadata() { | ||
| return ScanRuleMetadata.fromYaml(` | ||
| id: 100030 |
There was a problem hiding this comment.
Please reserve an ID by opening a PR against: https://github.com/zaproxy/zaproxy/blob/main/docs/scanners.md
| category: server | ||
| risk: medium | ||
| confidence: medium | ||
| cweId: 200 # CWE-200: Information Exposure |
There was a problem hiding this comment.
200 should not be mapped, please use something more specific.
| .setCweId(200) | ||
| .setWascId(13) |
There was a problem hiding this comment.
Details that are set/common in the metadata block don't need to be re-set here.
3 participants
This script detects potentially exposed MCP servers by sending MCP initialization requests