MCP CacheableResult Cross-Identity Leak (identity-dependent response marked publicly cacheable)

mcp-cache-scope-identity-leak is a high severity check in the ai category, written in python. Its source is templates/ai/mcp/mcp-cache-scope-identity-leak.py in cert-x-gen-templates.

What it checks

ACTIVE check. Reads the same MCP resource as two distinct identities and reports a response whose body depends on WHO asked yet carries the 2026-07-28 CacheableResult directive cacheScope “public” - a shared intermediary honouring it serves one caller’s content to another

There is a playbook for this check

MCP CacheableResult cross-identity leak (cacheScope: "public" on an identity-dependent response) sets out the use case, the probe flow, the oracle, and the fixture that proves it in both directions.

Header

Field	Value
Id	mcp-cache-scope-identity-leak
Severity	high
Language	python
Category	ai
Author	Bugb Research
Template version	1.0.0
Confidence	90
CVSS	7.5
Weakness	CWE-524, CWE-200
Tags	mcp, ai, agent, cache, cache-poisoning, cacheable-result, cache-scope, identity-leak, multi-tenant, active, cwe-524, cwe-200
Target kind	http
Oracle	property, diff

Conventions of the repository, not fields the engine reads

@target_kinds and @oracles are documented in the templates repository’s contribution guide, and cxg’s annotation parser does not carry them into a template’s metadata. Nothing at scan time selects on them. The annotation header schema is every field the parser does read.

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• https://modelcontextprotocol.io/specification
• https://cwe.mitre.org/data/definitions/524.html
• https://cwe.mitre.org/data/definitions/200.html
• https://www.rfc-editor.org/rfc/rfc9111.html#name-storing-responses-in-shared
• https://portswigger.net/web-security/web-cache-deception

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info mcp-cache-scope-identity-leak

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• ai is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.