MCP Objauthz Lab

## 🧪 MCP Object-Authz Lab

> A small, self-hostable, **vulnerable-by-design** [MCP](https://modelcontextprotocol.io) server for learning how **object-level / cross-tenant authorization** bugs (BOLA / IDOR — [CWE-639](https://cwe.mitre.org/data/definitions/639.html), [CWE-862](https://cwe.mitre.org/data/definitions/862.html)) appear in Model Context Protocol tools, and how to hunt them.

A multi-tenant note server exposing **six MCP tools**. Five are correctly authorized. **Exactly one** is missing its access check, so a caller in one organization can reach another organization's data through it.

The bug is subtle on purpose: the broken tool looks just like its siblings — it is missing a *single line*. **Find it, exploit it locally, then flip one switch to see it fixed.**

| | |
|:---|:---|
| 🐛 **Bug class** | Object-level / cross-tenant authorization (BOLA / IDOR) |
| 📚 **References** | [CWE-639](https://cwe.mitre.org/data/definitions/639.html) · [CWE-862](https://cwe.mitre.org/data/definitions/862.html) |
| 🧰 **Attack surface** | 6 MCP tools — 5 correctly authorized, **1 vulnerable** |
| 🔀 **Build toggle** | `LAB_MODE=vuln` (default) / `LAB_MODE=fixed` |
| 📦 **Requirements** | Node.js ≥ 20 |

---

## 🚀 Quickstart

Up and running in **under 5 minutes**. Requires **Node.js ≥ 20**.

```bash
npm install
npm run poc
```

**Expected output:**

```
MCP object-level authorization lab — two-way gate

  BUILD  ACTION                                 OUTCOME  EXPECT   OK
  vuln   note_get   cross-tenant (Bob → Acme)   DENIED   DENIED   ✓
  vuln   note_delete cross-tenant (Bob → Acme)  DELETED  DELETED  ✓
  fixed  note_delete cross-tenant (Bob → Acme)  DENIED   DENIED   ✓
  fixed  note_delete same-tenant (Bob → Globex) DELETED  DELETED  ✓

  Two-way gate: PASS (vuln exploits, fix blocks the cross-tenant delete and still allows the same-tenant one).
```

The PoC is a real MCP client. It spawns the server over stdio (**locally — no network, no third party**), authenticates as **Bob** (org *Globex*), and tries to reach a note owned by **Acme**. It runs a *two-way gate*:

| Build | Cross-tenant delete (Bob → Acme) | Control check | What it proves |
|---|---|---|---|
| **vuln** | ✅ **Succeeds** — the exploit | Correctly-scoped `note_get` still 🚫 **denied** | The server has a **single** broken tool, not a globally missing check |
| **fixed** | 🚫 **Blocked** | Bob deleting his *own* org's note still ✅ **works** | The fix does not over-block (no false positive) |

---

## 🎯 Why this lab exists

Most MCP security attention goes to **prompt injection** and tool-poisoning. Object-level authorization is a quieter, different class — and the usual prompt-injection test suites and scanners do **not** find it.

> 💡 **The rule that matters**
>
> When an MCP server is multi-tenant, every tool that resolves an object from a **client-supplied id** must verify the caller is allowed to touch *that* object. Miss the check on a single tool and you have a cross-tenant read, write, or delete — regardless of how good the prompt-injection defenses are.

Catching it takes *reading the authorization on each tool* — which is exactly the muscle this lab trains.

---

## 🧩 The challenge

Before you read `src/`: the server exposes **six note tools** —

`note_list` · `note_get` · `note_create` · `note_update` · `note_delete` · `note_search`

**Exactly one** lets a caller in one org affect another org's note. Which one, and what makes it different from the others?

<details>
<summary>💡 Hint</summary>

Three tools take a client-supplied `id` (`note_get`, `note_update`, `note_delete`). Two of them check that the resolved object belongs to your org. One does not.

</details>

<details>
<summary>🎯 Answer</summary>

**`note_delete`.** It resolves the note from the client-supplied `id` exactly like `note_get` and `note_update`, but (in `LAB_MODE=vuln`) it never calls `requireOrgAccess(session, note)`. The fix is that one line — the same check its siblings already perform. See the comment block in [`src/tools.js`](src/tools.js) above `note_delete`.

</details>

---

## 🏗️ How it is built

| File | Role |
|---|---|
| [`src/store.js`](src/store.js) | In-memory multi-tenant seed data: orgs *Acme* (Alice) and *Globex* (Bob), a few notes each. |
| [`src/auth.js`](src/auth.js