Tool Discovery
Enumerate available tools and their schemas via MCP tools/list or equivalent discovery endpoints
Reconnaissance · Stage 1
Map the target agent's attack surface, capabilities, and behavioral boundaries
MCP-EXPLOIT
Attacking Model Context Protocol server configurations, tool registrations, and inter-server trust
Reproduced in a controlled lab environment (DVAA) with documented steps.
ToolBot tools/list
Reproductions in Damn Vulnerable AI Agent, the OpenA2A intentionally-broken agent for kill-chain validation.
Recent observations
Technique-attributed observations from the AgentPwn + TrapMyAgent fleet, classified into Threat Matrix techniques by the registry evidence bridge. See the Attack Prevalence Index for the full distribution.
AgentPwn coverage
An AgentPwn trap page produces a payload tagged with this technique class. Following the AgentPwn taxonomy of trap pages shows what an agent encounters.
The Tool Discovery tier asks the agent to enumerate its MCP tools and schemas.
Evidence by source
Evidence timeline
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified llm_crawler/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified llm_crawler/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified llm_crawler/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified llm_crawler/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched a mcp-exploitation canary on agentpwn.com (category-level: the lure carried no payload id; classified browser/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Client fetched the canary embedded in APWN-MCP-001 on agentpwn.com (mcp-exploitation tier 1; classified browser/claimed)
Detection · HackMyAgent
npx hackmyagent secure --ciLive = implemented in hackmyagent; queued = declaredDefense · OASB controls
How to cite
AI Agent Threat Matrix T-1002 (Tool Discovery). OpenA2A, 2026. https://threats.opena2a.org/techniques/T-1002