Archived page from the earlier OMEGA site (October 2026). Its figures and statuses have not been re-checked since and may be out of date. Current research: Research. Current evidence record: Evidence.
OBSERVED
Finding · execute
Tools removed from the list an agent is shown were still there to call by name.
Tools removed from the list an agent is shown were still there to call by name.
Claim
In a server built to exhibit the bug, tools filtered from the discovery listing remained reachable through the call surface: a presentation-layer authorization control with no execution-layer enforcement behind it.
Status
OBSERVEDWitnessed in one instance. No claim about how often.
A mock MCP server built to exhibit the bug (authored). built for the study
Frame
stdio transport only; no HTTP, prompt injection or token scope.
Method
Read the advertised tool list, then probe whether un-advertised tools are still callable; an unrecognised denial reads as inconclusive.
Oracle
The call surface: whether tools/call succeeds for a tool absent from tools/list.
Negative control
Present The patched server passes; the vulnerable server fails with exit 1.
Denominator
1 of 3 tools listed, 3 of 3 reachable, on the mock.
Limitation
This is a demonstration against an authored mock, not a measurement of real servers. It does not test HTTP transport, prompt injection, or token scope, and a passing result does not mean a server is secure.