---
id: 3814
title: "Otto Support - Testing MCP Servers"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/otto-support-testing-mcp-servers"
published_at: "2026-06-03 00:00"
tags: ["ai-security", "pentesting", "agentic-ai", "vulnerability-research", "mcp", "nmap", "nuclei", "broken-access-control", "mcp-inspector"]
phying_url: "https://phying.com/item/3814"
lang: en
---

# Otto Support - Testing MCP Servers

## Summary

Closing the otto-support series, the team uses nmap, a Nuclei template, and MCP Inspector to expose an authorization gap that lets any unprivileged user delete other users' tickets.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2026-06-03 00:00
- **Original:** https://bishopfox.com/blog/otto-support-testing-mcp-servers
- **Phying News:** https://phying.com/item/3814