AutoGen Studio MCP Auth Middleware Bypass - Unauthenticated /api/mcp/ Access
Detects unauthenticated network connections to AutoGen Studio's Management Control Plane (MCP) WebSocket paths. AutoGen Studio's AuthMiddleware explicitly skips authentication for '/api/mcp/*' and '/api/ws/*' paths, typically on port 8081. This rule identifies attempts to access these paths without authentication, which could indicate reconnaissance or exploitation attempts against a misconfigured or vulnerable AutoGen Studio instance.
Microsoft Sentinel (KQL)
