MCPP-AUTHN06: Error responses leak internals¶


Family	Authentication challenge
Default severity	`medium`
Confidence	`high`
Mode	passive (default scan)
Spec revisions	all

Why it matters¶

Stack traces, debug pages, internal addresses and version banners help an attacker fingerprint the stack and find known vulnerabilities.

Remediation¶

Return generic error bodies (JSON-RPC error objects or RFC 6750 challenges) and log details server-side. Strip Server / X-Powered-By version banners at the proxy.

References¶

OWASP Error Handling Cheat Sheet

Suppressing¶

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-AUTHN06"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31