A black-box client that drives an authorized MCP server over its real transport, checks it, and preserves what it saw so a second analyst can reproduce the result.
| Assessment question | Use | Evidence to review |
|---|---|---|
| What does the server expose? | --mode tools, resources, or prompts | Discovery metadata and negotiated protocol version |
| Does input handling match the advertised schema? | --phase realistic then --phase aggressive | Requests, responses, rejection/acceptance outcome, timing |
| Are protocol boundaries robust? | --mode protocol, optionally --stateful | Per-message outcomes and spec-guard results |
| Does the advertised security boundary hold? | --security-audit and --auth-audit | Check IDs, evidence, source references, and auth metadata |
| What does a local server do on the host? | stdio plus safety controls and optional --runtime-probe | Process, network, filesystem, credential, and privilege observations |
| Can a pipeline detect an unusable target? | --fail-if-no-tools | Non-zero exit for no tools, auth failure, or unreachable target |
The fuzzer reports observations and useful reproductions. It does not certify a server, prove exploitability in every deployment, or replace manual review of authorization, business impact, and deployment context.
Every stage has a task-focused guide:
For the exact flags and current defaults, use the CLI reference. For protocol-version selection, see configuration.
Only test systems you are authorized to assess. Use dedicated credentials, bounded timeouts, low initial run counts, and a disposable target. For local stdio targets, combine --enable-safety-system with --fs-root and usually --no-network. These controls reduce accidental impact but are not an OS sandbox or a replacement for a container/VM.
Use this tool alongside the official MCP Security Best Practices, MCP authorization specification, and OWASP MCP Top 10. The project links applicable sources in finding evidence; a mapping is context for analyst triage, not a severity decision by itself.