Someone Is Scanning for Your MCP Servers and AI Assistant Credentials, (Mon, Jul 13th)

1. Executive summary

A 14-day log review of a low-traffic web host by SANS ISC has revealed a new category of internet-wide opportunistic scanning targeting Model Context Protocol (MCP) servers, AI coding assistant configuration/credential files, and exposed local LLM inference endpoints. The scanning is distributed (49 distinct source IPs for MCP handshakes alone) and demonstrates protocol-aware behaviour, sending valid JSON-RPC 2.0 initialize calls rather than blind path requests. No CVEs are associated with this activity; the risk to EMEA financial services stems from the rapid expansion of AI-agent attack surface — exposed MCP servers function as unauthenticated, machine-readable inventories of internal data sources and tools, and leaked AI assistant credentials provide direct access to those environments. No verified reference data was resolved for this item; all technical detail is single-sourced from the SANS ISC diary.

2. Regulatory framing

3. Technical analysis & attack chain

Confidence caveat: All technical detail below is single-sourced from one SANS ISC diary entry (https://isc.sans.edu/diary/rss/33150). No corroborating sources are available. Verify before enforcement.

Attack chain (confirmed steps from source)

1. Reconnaissance — MCP protocol handshake. Scanner sends POST /mcp with a valid JSON-RPC 2.0 body performing a Model Context Protocol initialize call. The request includes: - Content-Type: application/json - Body: {"id":1,"jsonrpc":"2.0","method":"initialize","params":{"capabilities":{},"clientInfo":{"name":"client","version":"0"},"protocolVersion":"2025-03-26"}} - The scanner uses a real MCP protocol version (2025-03-26) and waits for a server response. If the server responds to the initialize call, the attacker can enumerate exposed tools, connected data sources, and available actions. - Observed from 49 distinct source IPs over 14 days — distributed, not a single researcher.
2. Reconnaissance — MCP SSE transport discovery. Scanner requests GET /sse looking for the Server-Sent Events transport used by older MCP server implementations.
3. Reconnaissance — AI assistant configuration files. Scanner requests specific, current configuration paths from AI coding assistants (Claude, Cursor, VS Code). Paths are not guesses; they reflect real knowledge of how these tools store settings: - GET /.cursor/mcp.json - GET /.cursor/mcp_config.json - GET /.vscode/mcp.json - GET /.mcp/config.json - GET /.claude/settings.local.json - HEAD /.claude/.credentials.json - HEAD /.config/claude/.credentia (truncated in source)
4. Reconnaissance — credential file existence checks. Scanner uses HEAD requests for credential files (e.g., HEAD /.claude/.credentials.json) to check existence without downloading the body. This is an efficiency optimisation indicating a mature, wide campaign scanning a very large number of hosts. The AI assistant credential paths are bundled into the same wordlist as cloud credential files (GCP, AWS, Azure, Kubernetes service-account tokens), indicating the tooling authors treat AI assistant secrets as equivalent to cloud credentials.
5. Reconnaissance — exposed LLM inference endpoints. Scanner probes for unauthenticated local model endpoints: - GET /v1/models (OpenAI-compatible API) - GET /api/tags (Ollama API)
6. Reconnaissance — SSRF targeting cloud metadata. Scanner attempts SSRF via fetch/proxy endpoints to steal cloud instance credentials: - Target: metadata.google.internal (GCP metadata endpoint returning service-account tokens) - Parameter rotation across: url, uri, path, dest - Example pattern: /fetch?url=...metadata.google.internal - Also probes for Kubernetes service-account tokens via path traversal or misrouting: /var/run/secrets/.../serviceaccount/token

Technical specifics

• MCP servers: An MCP server is the bridge that lets an AI agent call tools and read data sources — databases, file systems, ticketing systems, internal APIs. An exposed, unauthenticated MCP server presents a remote, machine-readable menu of everything an agent can touch to anyone who completes the JSON-RPC handshake.
• AI assistant config files: Files like .claude/mcp.json and .cursor/mcp.json contain MCP client configuration with server endpoints and sometimes API keys. .claude/.credentials.json contains stored credentials for AI coding assistants. When developers accidentally deploy these to a web root, they leak.
• SSRF relevance to AI tooling: Agent and LLM tooling frequently includes fetch-style helpers that take a URL and retrieve it. An MCP server or agent tool that fetches arbitrary URLs is a ready-made SSRF primitive — exactly the kind of endpoint the SSRF probes are built to find.
• No attribution: No named threat actor is identified in the source. No MITRE ATT&CK technique IDs are referenced. Attribution is unconfirmed.

4. Mitigation & containment

P1 — Within 24 hours

1. Audit internet-facing web servers for MCP exposure. Search Apache/nginx/ModSecurity logs for POST /mcp requests containing "method":"initialize" and "protocolVersion":"2025-03-26". If any server responded with a 200, treat as a potential compromise — enumerate what tools and data sources that MCP server exposed.
2. Block MCP endpoints at the WAF/firewall for any server that should not be serving MCP traffic. Block POST /mcp and GET /sse at the edge for all non-MCP hosts.
3. Check for leaked AI assistant credential files in web roots. Search for the following files across all web-accessible directories and remove immediately if found: - .claude/mcp.json - .cursor/mcp.json - .cursor/mcp_config.json - .vscode/mcp.json - .mcp/config.json - .claude/settings.local.json - .claude/.credentials.json - .config/claude/.credentia
4. Check for exposed LLM inference endpoints. Ensure /v1/models and /api/tags are not reachable without authentication on any internet-facing host. If found, restrict to localhost or internal network only.

P2 — Within 72 hours

5. Audit SSRF protection on all proxy/fetch endpoints. Ensure no endpoint accepting parameters named url, uri, path, or dest will follow redirects to metadata.google.internal or 169.254.169.254 (AWS/Azure metadata). Block these destinations at the application layer.
6. Review Kubernetes service-account token exposure. Ensure /var/run/secrets/.../serviceaccount/token is not accessible via path traversal or misrouting on any web-facing application.
7. Add ModSecurity/WAF rules for the specific AI-agent recon paths listed in §3. Return 403 or 404 for all requests to these paths on servers that do not host AI infrastructure.

P3 — Within 7 days

8. Inventory all MCP server deployments across the organisation. Document which servers are running, where they are exposed, what authentication they require, and what data sources/tools they connect to. Treat every MCP server as a sensitive, internet-facing asset.
9. Implement network-level access controls for all MCP servers. MCP servers should not be internet-facing without strong authentication and authorisation. Place behind VPN, zero-trust network access, or internal-only routing.
10. Add .gitignore / deployment pipeline controls to prevent AI assistant configuration and credential files from being deployed to web roots. Ensure .claude/, .cursor/, .vscode/, and .mcp/ directories are excluded from build artifacts and web root copies.
11. Review all MCP servers for fetch/SSRF primitives. Any MCP tool that accepts a URL parameter and retrieves it should implement an allowlist of permitted destinations and block cloud metadata endpoints.

5. Indicators of compromise

No static IOCs (IP addresses, hashes, domains) are provided in the source material. The source anonymised all server IPs and hostnames. The 49 distinct source IPs for MCP handshakes are referenced but not enumerated.

The following are behavioural indicators (request patterns) rather than traditional IOCs:

http_request  POST /mcp
http_request  GET /sse
http_request  GET /.cursor/mcp.json
http_request  GET /.cursor/mcp_config.json
http_request  GET /.vscode/mcp.json
http_request  GET /.mcp/config.json
http_request  GET /.claude/settings.local.json
http_request  HEAD /.claude/.credentials.json
http_request  HEAD /.config/claude/.credentia
http_request  GET /v1/models
http_request  GET /api/tags
http_request  /fetch?url=...metadata.google.internal
http_request  /var/run/secrets/.../serviceaccount/token

6. Detection

rule AT_MCP_AI_Agent_Recon_Scanning {
    meta:
        author = "Adverse Trace"
        date = "2026-07-13"
        reference = "https://isc.sans.edu/diary/rss/33150"
        description = "Detects MCP server handshake and AI assistant credential file reconnaissance patterns observed in web server logs"
    strings:
        $mcp_init_method = "\"method\":\"initialize\""
        $mcp_protocol_ver = "\"protocolVersion\":\"2025-03-26\""
        $mcp_jsonrpc = "\"jsonrpc\":\"2.0\""
        $mcp_clientinfo = "\"clientInfo\":{\"name\":\"client\",\"version\":\"0\"}"
        $path_mcp = "/mcp"
        $path_sse = "/sse"
        $path_cursor_mcp = "/.cursor/mcp.json"
        $path_cursor_mcp_config = "/.cursor/mcp_config.json"
        $path_vscode_mcp = "/.vscode/mcp.json"
        $path_mcp_config = "/.mcp/config.json"
        $path_claude_settings = "/.claude/settings.local.json"
        $path_claude_creds = "/.claude/.credentials.json"
        $path_claude_config_creds = "/.config/claude/.credentia"
        $path_v1_models = "/v1/models"
        $path_api_tags = "/api/tags"
        $ssrf_metadata = "metadata.google.internal"
        $k8s_sa_token = "/var/run/secrets/.../serviceaccount/token"
    condition:
        3 of them
}

title: Detect MCP Server and AI Assistant Credential Reconnaissance
id: at-2026-07-13-283-mcp-recon
status: experimental
description: >
    Detects HTTP requests probing for MCP servers, AI assistant configuration/credential
    files, exposed LLM endpoints, and SSRF targeting cloud metadata. Based on patterns
    observed in SANS ISC diary 33150.
references:

    - https://isc.sans.edu/diary/rss/33150
author: Adverse Trace
date: 2026/07/13
logsource:
    category: webserver
    product: apache
detection:
    mcp_handshake:
        c-uri|contains: '/mcp'
        sc-method: POST
        request_body|contains:

            - '"method":"initialize"'
            - '"protocolVersion":"2025-03-26"'
    mcp_sse:
        c-uri: /sse
        sc-method: GET
    ai_config_files:
        c-uri|contains:

            - '/.cursor/mcp.json'
            - '/.cursor/mcp_config.json'
            - '/.vscode/mcp.json'
            - '/.mcp/config.json'
            - '/.claude/settings.local.json'
            - '/.claude/.credentials.json'
            - '/.config/claude/.credentia'
    llm_endpoints:
        c-uri|contains:

            - '/v1/models'
            - '/api/tags'
    ssrf_metadata:
        c-uri|contains:

            - 'metadata.google.internal'
            - '/var/run/secrets/.../serviceaccount/token'
    condition: mcp_handshake or mcp_sse or ai_config_files or llm_endpoints or ssrf_metadata
fields:

    - c-ip
    - sc-method
    - c-uri
    - request_body
    - sc-status
falsepositives:

    - Legitimate MCP server access from known clients
    - Legitimate LLM API access from known applications
    - Security scanning tools testing for these paths
level: medium

7. Sources

• SANS Internet Storm Center, "Someone Is Scanning for Your MCP Servers and AI Assistant Credentials," Manuel Humberto Santander Peláez, https://isc.sans.edu/diary/rss/33150, 2026-07-13

8. Adverse Trace position

Severity: Medium. This is reconnaissance, not exploitation — but it confirms that AI-agent infrastructure (MCP servers, AI assistant credentials, local LLM endpoints) has been added to the standard target list of internet-wide scanning campaigns. The protocol-aware nature of the MCP handshakes (valid JSON-RPC 2.0 initialize calls with a real protocol version) and the use of HEAD requests for credential file existence checks indicate mature, purpose-built tooling. For EMEA financial services, the risk is acute: firms rapidly adopting AI coding assistants and MCP servers may have inadvertently exposed these assets on internet-facing hosts, and the scanners are already looking for them. An exposed, unauthenticated MCP server is effectively a remote inventory of internal data sources and tools — a critical exposure if it connects to databases, file systems, or internal APIs. Confidence caveat: This advisory is single-sourced from one SANS ISC diary entry; the findings are plausible and technically consistent but uncorroborated by additional sources. Adverse Trace will monitor for corroborating reports and for enumeration of the 49 source IPs. We recommend clients immediately audit logs for the request patterns in §5 and inventory all MCP server deployments per §4.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.