A Reconnaissance Methodology for Mapping the Pre-Authentication Attack Surface of Model Context Protocol Servers

The Model Context Protocol (MCP) is becoming standard infrastructure for connecting language models to external tools and data. Published MCP security work concentrates almost entirely on the agent layer — tool poisoning, prompt injection, and malicious tool descriptions — where the threat is semantic and the victim is the model. That focus leaves a gap. A remotely hosted MCP server is also an ordinary HTTP deployment with an OAuth 2.1 authorization stack in front of a JSON-RPC endpoint, and that stack is reachable by an unauthenticated attacker who never speaks to the model at all. This surface is structurally different from a typical REST API: the protocol mandates machinereadable discovery metadata, encourages open dynamic client registration, and hides the entire tool schema behind a bearer token, which concentrates pre-authentication attack surface into the authorization flow itself. I present a four-stage reconnaissance methodology for mapping that surface on any MCP deployment, with a checklist a tester can apply directly. I illustrate it with an anonymised worked example from authorized testing. No vulnerability was confirmed in that engagement, and none is claimed here; this is methodology, not disclosure.