AGENTFORCE-MCP-25: Unauthenticated MCP Proxy Spawns Request-Supplied Stdio Command
🚨 Critical · MCP Client Security
Detects MCP proxies and bridges (inspector-style tools) whose HTTP route takes command and args from the query string or body and starts them as a stdio MCP server (new StdioClientTransport, spawn, exec) while the route has no authentication (no token / session check, no auth middleware). Any web page the user visits can reach a local proxy (CSRF, DNS rebinding, 0.0.0.0 binding) and run a command. Severity: critical; high when the proxy checks Origin / Host against an allowlist but still has no token.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-25 |
| Severity | Critical |
| Category | MCP Client Security |
Remediation
Require a per-session token on every proxy route (random, compared with timingSafeEqual), validate Origin and Host against an allowlist, bind to 127.0.0.1, and start only commands the user configured locally rather than ones named in the request.