AGENTFORCE-MCP-24: MCP Client Opens Server-Supplied Authorization URL Without Validation
🚨 Critical · MCP Client Security
Detects MCP clients and proxies that take the OAuth authorization URL supplied by the MCP server (the authorization_endpoint in its OAuth metadata, or the URL passed to redirectToAuthorization) and pass it to a launcher: the 'open' package, exec / spawn of open, xdg-open, start or cmd, Electron shell.openExternal, or Python webbrowser, with no scheme check or URL sanitizer on the way. A malicious or compromised server can return a URL that makes the launcher run a command on the user's machine. Severity: critical when the launcher runs a program (open package, shell commands); high for browser-only launchers (openExternal, webbrowser).
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-24 |
| Severity | Critical |
| Category | MCP Client Security |
Remediation
Parse the URL with new URL() and accept only https: (http: for localhost), or pass it through a sanitizer (strict-url-sanitise, @braintree/sanitize-url) before opening it; never build a shell command from it.