vscode-mcp-json: Visual Studio Code MCP Configuration ("mcp.json") Exposure

2026-01-16 Visual Studio Code PoC Public

Description

Detected exposed VS Code MCP (Model Context Protocol) configuration files (mcp.json) which may contain sensitive information including API keys, server endpoints, authentication tokens, and tool configurations for AI assistants and language models.

PoC

id: vscode-mcp-json

info:
  name: Visual Studio Code MCP Configuration ("mcp.json") Exposure
  author: DhiyaneshDk
  severity: low
  description: |
    Detected exposed VS Code MCP (Model Context Protocol) configuration files (mcp.json) which may contain sensitive information including API keys, server endpoints, authentication tokens, and tool configurations for AI assistants and language models.
  reference:
    - https://code.visualstudio.com/docs/copilot/chat/mcp-servers
    - https://modelcontextprotocol.io/
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"mcp.json"
  tags: exposure,vscode,config,mcp,ai,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/mcp.json"
      - "{{BaseURL}}/.mcp.json"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"mcpServers": {'
          - '"args":'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100c75c747be858b535cc0879b524a82319af9543d431724626e533186fb5b92ef3022100df6b06eb52858a54b5ddce6e2234844a6dc480ee520d2250951aa5bb1d45658c:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/files/vscode-mcp-json.yaml

References

Related Vulnerabilities