Unauthenticated external tools/list discovery probes against MCP servers

Arnold Chan@slaz

•updated Sep 6, 2026•1•0•2

Detects high-frequency requests for 'tools/list' from a single source IP across multiple unique destination hosts. This pattern is indicative of a breadth-first scan attempting to identify reachable Model Context Protocol (MCP) servers, rather than typical legitimate client-to-server communication.