Mcp jsonrpc2 ultimate detect

[SemenchenkoA]

Template / PR Information

Hi,

This PR propose a template to detect the exposed MCP servers via multiple JSON-RPC 2.0 methods

• References:
  https://lab.wallarm.com/wallarm-research-nuclei-template-counter-threats-targeting-llm-apps/

Template Validation

I've validated this template locally?

• YES
• NO

[GeorginaReeder]

Thanks for your contribution @SemenchenkoA , we appreciate it! :)

As a token of appreciation for your valuable contribution, you can grab some cool PD Stickers from here http://nux.gg/stickers .

We also have a Discord server, which you’re more than welcome to join. It's a great place to connect with fellow contributors and stay updated with the latest developments!

[ehsandeep]

@SemenchenkoA thanks for adding the template. Regarding severity/impact, is it possible that some MCP servers are intentionally exposed publicly, or should they always be behind auth? If some are meant to be public, I’m not sure how to differentiate between the two cases, but I wanted to check with you before merging this.

[SemenchenkoA]

MCP servers should not be publicly exposed without auth

[Arrnitage]

@SemenchenkoA thanks for adding the template. Regarding severity/impact, is it possible that some MCP servers are intentionally exposed publicly, or should they always be behind auth? If some are meant to be public, I’m not sure how to differentiate between the two cases, but I wanted to check with you before merging this.

I suggest adding an MCP Server detection template.Weather it is public or private

[princechaddha]

Hello @SemenchenkoA, thank you so much for sharing this template with the community and contributing to this project 🍻

I have made a few changes and updated the severity to ‘unknown,’ as the APIs may be read-only by design or may require authentication depending on the matched method. Let me know if the changes look good; then we can merge the templates. Sorry for the delay, and thank you again