T09 · Insecure Skill Coding Practices
Error
- Location
reference/node_mcp_server.md:719- Finding
Unauthenticated MCP HTTP Endpoint Exposed on All Network Interfaces
- Content
View full analysis
{ const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true }); res.on('close', () => transport.close()); await server.connect(transport); await transport.handleRequest(req, res, req.body); }); const port = parseInt(process.env.PORT || '3000'); app.listen(port, () => { console.error(`MCP server running on http://localhost:${port}/mcp`); }); } ``` ### Technical Analysis The documented HTTP server accepts MCP requests without authenticating or authorizing the requesting client. Checking that `EXAMPLE_API_KEY` exists only confirms that the server possesses an upstream credential; it does not restrict who can invoke the MCP endpoint. The endpoint also lacks: - OAuth or bearer-token validation. - Per-tool authorization. - `Origin` and Host-header validation. - DNS-rebinding protection. - Request-size and rate limits. - Explicit loopback binding. Calling `app.listen(port)` without a host generally listens on all available interfaces. The log message stating that the server is running on `localhost` does not enforce loopback-only accessibility. This example conflicts with the security recommendations in `reference/mcp_best_practices.md:154-177`, which require token validation, Origin validation, DNS-rebinding protection, and binding local servers to `127.0.0.1`. ### Attack Path 1. A developer copies the documented ...[truncated 1206 chars]- Remediation
View remediation
{ console.error(`MCP server running on http://127.0.0.1:${port}/mcp`); }); ``` 2. Require authenticated inbound requests before invoking the MCP transport. For remote deployments, implement OAuth 2.1 and validate: - Token signature and expiration. - Issuer and audience. - Scopes required for the requested operation. 3. Enforce per-tool authorization rather than relying only on endpoint-level authentication. 4. Validate the `Origin` and Host headers and enable the MCP SDK's DNS-rebinding protections where supported. 5. Add request-body size limits, rate limiting, TLS, secure reverse-proxy configuration, and security logging. 6. Use separate credentials with narrowly scoped read-only permissions when destructive access is unnecessary. 7. Correct the guide's log message and deployment documentation so that claimed network exposure matches the actual bind configuration. ]]>