Agent-Hellboy / Agent-Hellboy/mcp-server-fuzzer
Documentation/error improvement request on running with bearer token
- Lingua principale
- Python
- Stelle
- 46
- Fork
- 6
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
Hello and thanks for putting together this tool! I am trying to run the fuzzer against a local server requiring a bearer token and was not able to figure this out from the current docs originally:
Wrt to running with a config.yaml:
```bash
python3 -m mcp_fuzzer --config config.yaml --server localhttp
```
getting `error: unrecognized arguments: --server localhttp`
When creating the following config
```yaml
mode: "tools"
protocol: http
endpoint: "http://localhost:8080/mcp"
runs: 10
phase: "aggressive"
timeout: 30.0
log_level: "INFO"
safety_enabled: true
max_concurrency: 5
phase: both
auth:
type: oauth
token: "xxx"
header_name: "Authorization"
```
as per [this doc](https://agent-hellboy.github.io/mcp-server-fuzzer/configuration/configuration-loader/?h=config.yaml#before-command-line) I get
```bash
mcp-fuzzer ❯ python3 -m mcp_fuzzer --config config.yaml
Error: --endpoint is required for fuzzing operations
```
I also tried to follow the instructions on
```
export MCP_API_KEY=xxx
export MCP_TOOL_AUTH_MAPPING='{"secure_tool":"api_key"}'
python3 -m mcp_fuzzer --mode tools --protocol http --endpoint http://localhost:8080/mcp --runs 2 --timeout 5 --auth-env
```
trying to pass in my API key but getting `HTTP 401: no bearer token`.
I've also tried using `python3 -m mcp_fuzzer --mode tools --protocol http --endpoint http://localhost:8080/mcp --runs 2 --timeout 5 --auth-config auth_config.json` with
```json
{
"providers": {
"api_key": {
"type": "oauth",
"token": "xxx"
}
},
"tool_mappings": {
"secure_tool": "api_key"
}
}
```
as well as
```json
{
"providers": {
"api_key": {
"type": "api_key",
"api_key": "xxx",
"header_name": "Authorization",
"prefix": "Bearer"
}
},
"tool_mappings": {
"secure_tool": "api_key"
}
}
```
But getting 401 still.
Had also tried
```json
{
"providers": {
"oauth": {
"type": "oauth",
"token": "xxx"
}
},
"tool_mappings": {
"secure_tool": "oauth"
}
}
```
Btw, this is a golang mcp server, and I also tried STDIO as follows
```
mcp-fuzzer ❯ mcp-fuzzer --mode tools --protocol stdio --endpoint "go run /" --runs 10 --enable-safety-system
MCP Fuzzer - TOOLS Mode
Protocol: STDIO
Endpoint: go run
2025-11-04 11:38:53,546 - root - ERROR - Failed to fetch tools from server: No response received from stdio transport
Traceback (most recent call last):
File "/Users/nettrino/tools/mcp-server-fuzzer/mcp_fuzzer/transport/base.py", line 60, in get_tools
response = await self.send_request("tools/list")
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/nettrino/tools/mcp-server-fuzzer/mcp_fuzzer/transport/stdio.py", line 199, in send_request
raise Exception("No response received from stdio transport")
Exception: No response received from stdio transport
2025-11-04 11:38:53,548 - mcp_fuzzer.client.tool_client - WARNING - Server returned an empty list of tools.
```
Another nice to have would be some better error reporting in case of a bad json passed - currently getting `Unexpected error: 'api_key'` and similar, which does not inform the user what the required/expected values are.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.