aspex-attack

Red-team a live MCP server with adversarial inputs. Advanced, opt-in, only against servers you own.

Authorization required. aspex-attack calls real tools with malicious payloads. Only run it against servers you own or have explicit written permission to test. Unauthorized probing may violate computer-misuse law. The tool asks you to confirm before sending anything.

aspex scan tells you what a server could do. aspex-attack checks whether it actually falls for it: it connects to your configured servers, enumerates their tools, sends adversarial inputs to matching parameters, and inspects the responses for signs of success (reflected injection text, file contents that should not be readable, cloud metadata, stack traces).

aspex-attack                          # every configured server, after a y/N confirmation
aspex-attack --server filesystem      # one server
aspex-attack --categories ssrf,path-traversal
aspex-attack --json --fail-on high    # CI

Flags

Flag	Description
--server <name>	Probe only this configured server
--clients <list>	Only servers configured in these clients (default: all supported clients)
--categories <list>	Comma-separated: prompt-injection, path-traversal, ssrf, error-disclosure, schema-abuse, prompt-leakage
--timeout <seconds>	Per-probe timeout (default 10)
--json	Machine-readable output
--fail-on <sev>	Exit 1 when findings reach this severity: critical, high, medium, low, off (default high)
--no-color	Plain-text output

There is no positional target. aspex-attack probes servers it discovers in your client configs, the same way aspex scan does. To test a server that is not configured yet, add it to a client config first (or to a project .mcp.json).

What it sends

Payloads are chosen per tool parameter from the tool’s input schema, so a path parameter gets traversal payloads, a URL parameter gets SSRF payloads, and a free-text parameter gets injection and leakage payloads. 18 payloads across 6 categories:

Category	Payloads	Tests
prompt-injection	4	Instruction overrides and role changes reflected back by the tool
path-traversal	4	../ escapes and encoded variants returning file contents outside the allowed root
ssrf	4	Cloud metadata endpoints (169.254.169.254), localhost, internal addresses
error-disclosure	3	Oversized and malformed inputs that leak stack traces or internal paths
schema-abuse	1	Prototype-pollution style object injection
prompt-leakage	2	Elicitation of embedded system prompts or credentials

Each payload comes with detectors that decide whether the response indicates the attack landed. A finding is only raised on a positive detector, not on the mere act of accepting the input.

Reading results

aspex-attack --server filesystem

  Only run against servers you own or have explicit written permission to test.

  Proceed? [y/N] y

  filesystem  4 tools, 22 probes

  CRITICAL  path-traversal/dotdot-etc-passwd   read_file   response contained /etc/passwd contents
  MEDIUM    error-disclosure/oversized-string  search      stack trace with internal path in error

  2 findings  (1 critical, 1 medium)

Exit code is 1 when a finding reaches --fail-on (default high).

In CI

Only against a staging or test deployment, never production.

- name: Red-team the MCP server
  run: aspex-attack --server my-server --categories ssrf,path-traversal --json --fail-on high

Relationship to aspex scan

aspex scan redteam runs the same probes from inside the scanner and is kept for compatibility; aspex-attack is the standalone binary with the confirmation prompt and its own exit code. Use aspex scan for everyday auditing and reach for aspex-attack when you need proof, not a score.