reap / rules / recon: capability surface
Enumerated MCP tool surface is likely incomplete (dynamic dispatch detected)
mcp-dynamic-dispatch ASI09 Human-Agent Trust Exploitation severity: high
What it detects
Dispatch/search tool pattern implying a hidden capability surface larger than tools/list reports. ASI09. Pattern-matching heuristic, evadable by design — treat as a lead, not a confirmed undercount.
Inspects tools/list for a search/discovery tool plus a generic executor tool (free-form args + required identifier); flags that the declared surface likely undercounts real callable tools. Pattern-matching heuristic, evadable.
applies to MCP endpoints
Why it matters
The real callable surface exceeds what tools/list reports, so any inventory built from it is incomplete. That is an auditability gap.
Example finding
HIGH mcp-dynamic-dispatch MEDIUM CONFIDENCE Enumerated MCP tool surface is likely incomplete (dynamic dispatch detected) Discovery tool(s) search_tools and executor tool(s) run_tool were detected. This indicates tools/list likely undercounts the real capability surface because callable tools can be reached through search + dispatch. Evidence POST /mcp → 200
from a scan of reap-range, bad target
Fix
Expose a complete dispatchable tool manifest or provide a discoverable read-only tool inventory (for example, an extended list endpoint) so downstream security tooling can account for the full surface.
On reap-range
| insecure target | bad/mcp (search_tools + run_tool) · High |
| correct target | good/mcp has no dispatcher-shaped tool |
Run only this check
reap -t https://your-host/mcp --authorized --include mcp-dynamic-dispatch
Not installed? Install REAP. Only scan systems you own or are authorised to test. Reference: docs/PROBES.md.