#143 · New: MCP Endpoint Discovery & External Scanning in Escape ASM

Escape ASM now natively supports the discovery and external scanning of unauthenticated MCP (Model Context Protocol) endpoints, extending coverage to a new generation of AI-native APIs.

Why this matters¶

As teams adopt MCP to connect LLMs with tools, data sources, and internal services, new externally exposed attack surfaces are emerging.

Security teams need to:

Know where MCP endpoints are exposed
Detect unauthenticated or misconfigured MCP servers
Reduce blind spots in AI-native infrastructure

This update brings MCP endpoints into Escape ASM’s continuous discovery and monitoring pipeline.

What’s included today¶

For this initial release, we focused on the ASM layer, fully integrated into existing scans.

Escape ASM now provides:

Automatic MCP discovery: MCP endpoints are detected automatically, just like any other internet-facing asset.
External surface scanning: Escape analyzes exposed MCP servers and configurations, including:
- Detection of unauthenticated MCP endpoints
- Identification of externally reachable MCP services that may present security risks

This helps teams quickly identify high-risk MCP exposures before attackers do.

Setup¶

No setup required. MCP discovery and scanning are enabled by default as part of Escape ASM.

If you’re already running ASM, MCP endpoints are automatically included.

Looking for design partners for next steps in security testing¶

This release marks the first step toward full ASM + Automated Security Testing coverage for MCP-based architectures. We’re actively looking for design partners using MCP in real-world environments to help shape the next phase of Escape’s security testing for MCPs.

Design partners will get:

Early access to authenticated MCP testing
Influence over attack scenarios and coverage
Direct collaboration with the Escape product team

Reach out to your dedicated Escape contact if you’d like to participate! 🙏