> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/pentests/configure-a-pentest/testing-mcp-servers.md).

# Testing MCP Servers

Aikido Pentest can test your Model Context Protocol (MCP) server. Point an assessment at your MCP endpoint, tell Aikido how to authenticate, and the agents handle the rest.

{% hint style="warning" %}
Run MCP server pentests on a staging or test environment. Agents send requests to your endpoint and may create, modify, or delete data through it.
{% endhint %}

## What gets tested

Aikido probes the tools, resources, and prompts your server exposes. Typical focus areas:

* **Tool discovery** – which tools, resources, and prompts the server exposes, and whether any should not be reachable
* **Authorization** – whether unauthenticated or low-privilege callers can invoke tools or read resources they shouldn't
* **Unsafe tool use** – parameter injection, SSRF-style behavior, command execution, and data exfiltration through tool calls
* **Sensitive data exposure** – secrets, tokens, or cross-tenant data returned by tools or resources
* **Integration risk** – weak trust boundaries between the MCP server and the downstream systems its tools reach

For background on agent- and tool-specific risks, see [OWASP Top 10 for Agentic Applications](/pentests/coverage-and-findings/what-issues-can-aikido-pentest-find/owasp-top-10-for-agentic-applications.md).

## What you need

* A **remote endpoint** for the MCP server (for example, `https://mcp.staging.example.com/mcp`).
* The **authentication** the server expects, usually a token or API key sent as a header.
* Ownership of the domain so it can be [verified](/pentests/configure-a-pentest/domain-verification.md).
* Aikido's [pentest IP addresses](/pentests/prepare-a-pentest/ip-addresses-for-pentest.md) added to your firewall, WAF, or API gateway allowlist so agents can reach the endpoint.

## Set up the pentest

{% stepper %}
{% step %}

### Add the endpoint to scope

Create an assessment, and on the **Scope** step enter the MCP server's endpoint as the target. Use the exact URL and path clients connect to, such as `https://mcp.staging.example.com/mcp`.

Complete [domain verification](/pentests/configure-a-pentest/domain-verification.md) for the host serving the endpoint. If the server is only reachable on an internal network, use the [Aikido Broker](/miscellaneous-info/aikido-broker-for-internal-applications.md): add the internal MCP URL as a broker resource and select that broker URL in scope.
{% endstep %}

{% step %}

### Provide authentication

On the step **Test Users,** provide the instructions on how to connect to your MCP. This can be done in two main ways:

1. Authenticating to the MCP server directly:
   1. **Bearer token (most common).** MCP's authorization standard is OAuth 2.1, so most servers expect an access token. Mint a token for a test identity and add it as `Authorization: Bearer <token>`.
   2. **API key.** Some servers use a key header instead, such as `X-API-Key: <key>`.
   3. **Multi-tenant routing.** Add any tenant or workspace headers your server requires alongside the token.
2. Authenticating through an interactive user login flow: provide the step by step instructions on how the user can log in with the browser and can get access to the session token.
   {% endstep %}

{% step %}

### Add context, then launch

For the best results, link the **MCP server's code repository** in the **Code & Documentation** step. This promotes the run to a whitebox pentest and gives the agents the maximum context to uncover deeper logic-flow vulnerabilities. Aikido reads the source to map the tools, their callers, and the downstream systems they reach.

If you can't link the repository, use **Additional context** to describe the actions the server exposes, which callers or roles should reach each one, and the downstream systems they touch (databases, internal APIs, file storage).

Finish the remaining **Safety Check**, **Pricing**, and **Summary** steps, then start the run. If the server is sensitive to high request volume, lower the **Maximum Requests Per Second** on the **Safety Check** step to ease load.
{% endstep %}
{% endstepper %}

## Tips

* **Use a dedicated test instance** with non-production data, and mock or disable destructive actions where you can.
* **Issue a test token** with the permissions you want validated, and rotate it after the assessment.
* **Match production.** The endpoint, path, and auth you scope should be what real clients use.

## Need help?

If agents can't reach your endpoint or authentication fails, open the **Intercom chat** in the bottom right corner. Our team is here to help!


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/pentests/configure-a-pentest/testing-mcp-servers.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.