Skip to content
.ca
sign in
detection rulesuricata

MCP JSON-RPC initialize from external source

First seen
2026-07-18
Last seen
2026-07-18
Used in
1 post
SuricataMCP JSON-RPC initialize from external source
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"MCP JSON-RPC initialize from external source"; flow:to_server,established; http.method; content:"POST"; http.request_body; content:"jsonrpc"; content:"initialize"; distance:0; within:80; content:"protocolVersion"; distance:0; within:120; classtype:attempted-admin; sid:1000637001; rev:1; metadata:created_at 2026_07_10, deployment Ingress;)

Posts using this rule

  • highn4d/NadMesh: C2-Coordinated Propagation System Weaponizes MCP

    Ingress - any MCP port · SID 1000637001

    Fires on inbound HTTP POST containing MCP JSON-RPC `initialize` from an external source. In environments where MCP access is restricted to local or trusted clients, an external initialization request is anomalous regardless of whether it comes from n4d or another scanner.