mcp-idprobe released to test MCP cross-tenant leak

A developer released mcp-idprobe, a Python tool that checks MCP servers for cross-tenant data leaks (CVE-2026-111770). The flaw in @modelcontextprotocol/server 2.0.0–2.2.0 stems from a shared request table keyed by bare id and triggers without an attacker; it is fixed in 2.3.0.

• Affects @modelcontextprotocol/server 2.0.0–2.2.0, fixed in 2.3.0
• Leak occurs with two normal clients, no attacker needed
• Tool opens two sessions and plants unique secrets per request
• Includes static scan and CI mode with exit code 2