home · demo · events · compare: remote-inspector-proxy-auth-bypass

MCP Inspector / devtool auth-bypass bounded RCE proof

MCP01MCP07tools/call

What just happened in your session

vulnerablecompare-vuln-remote-inspector-proxy-auth-bypass2026-09-07T15:42:44.992339+00:00
side effect landed in /app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt · canary CANARY_remote_inspector_proxy_auth_bypass_037bdd9092de4240555a7de7
defendedcompare-def-remote-inspector-proxy-auth-bypass2026-09-07T15:42:44.992768+00:00
blocked by inspector_proxy_auth_policy · logged to var/telemetry.jsonl
Tool description that differed: launch_server

poisoned

Simulate launching an MCP server through the Inspector proxy. Vulnerable mode does not check arguments. Defended mode requires admin_token + origin to match.

sanitised

Simulate launching an MCP server through the Inspector proxy. Vulnerable mode does not check arguments. Defended mode requires admin_token + origin to match.

Vulnerable mode

violation_detected: truesecret_exfiltrated: false
✗ The attack succeeded
where it landed
  • sandbox/effects/inspector-rce-proof-<session>.txt
bounded rce proof
Artifact
/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt
Auth checked
False
Would execute
False
Note
no real subprocess; bounded proof file only
telemetry events for this run
sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode
impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt
sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode
impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt
sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode
impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt
sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode
impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt
sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode
impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt
sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode
impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt
sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode
impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt
Background
launch_server gates a privileged subprocess on an admin_token, but the default token is the literal string 'admin' and the Origin allowlist is disabled. Any caller that guesses the default token, or sends a request from a non-allowlisted origin, can spin up a privileged MCP subprocess in another session's namespace.

Defended mode

violation_detected: truesecret_exfiltrated: falseblocked_by: inspector_proxy_auth_policy
✓ The defense blocked the attack
where it landed
  • var/telemetry.jsonl
rule that fired
inspector_proxy_auth_policy
auth decision
Check
admin_token
Reason
missing or wrong admin token
Would execute
False
telemetry events for this run
policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked
policy.inspector_proxy_auth_policy: missing or wrong admin token
policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked
policy.inspector_proxy_auth_policy: missing or wrong admin token
policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked
policy.inspector_proxy_auth_policy: missing or wrong admin token
policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked
policy.inspector_proxy_auth_policy: missing or wrong admin token
policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked
policy.inspector_proxy_auth_policy: missing or wrong admin token
policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked
policy.inspector_proxy_auth_policy: missing or wrong admin token
policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked
policy.inspector_proxy_auth_policy: missing or wrong admin token
Background
The defended path requires a non-default admin_token sourced from a Kubernetes secret, enforces the Origin allowlist, and binds the launched subprocess to the requesting session_id. Default-token, foreign-origin or cross-session launches are refused with the specific failed check.
Background on this attack class

Bounded MCP Inspector / devtool auth-bypass RCE-class demo. Inspired by CVE-2025-49596 (MCP Inspector). The vulnerable mode accepts an unauthenticated launch request and creates a bounded proof file via ``ImpactRunner.write_sandbox_file``. There is no real subprocess. The defended mode requires an admin token and a matching Origin header.

Developer view: raw outputs, tools/list, MCP Inspector
Vulnerable mount: http://mcp-sec.data.mayflower.tech/mcp/inspector-proxy-auth-bypass/vulnerable/
Defended mount: http://mcp-sec.data.mayflower.tech/mcp/inspector-proxy-auth-bypass/defended/
Open in MCP Inspector: run npx @modelcontextprotocol/inspector locally and paste either URL above as a Streamable HTTP server.
DemoResult: vulnerable
{
  "experiment": "remote-inspector-proxy-auth-bypass",
  "mode": "vulnerable",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [],
  "events": [
    {
      "type": "bounded_rce_proof",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "auth_checked": false,
      "would_execute": false,
      "note": "no real subprocess; bounded proof file only"
    }
  ]
}
DemoResult: defended
{
  "experiment": "remote-inspector-proxy-auth-bypass",
  "mode": "defended",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [
    "inspector_proxy_auth_policy"
  ],
  "events": [
    {
      "type": "auth_decision",
      "check": "admin_token",
      "reason": "missing or wrong admin token",
      "would_execute": false
    }
  ]
}
tools/list (vulnerable)
launch_server
description
Simulate launching an MCP server through the Inspector proxy. Vulnerable mode does not check arguments. Defended mode requires admin_token + origin to match.
inputSchema
{
  "properties": {
    "session_id": {
      "default": "mcp-vulnerable",
      "title": "Session Id",
      "type": "string"
    },
    "admin_token": {
      "default": "",
      "title": "Admin Token",
      "type": "string"
    },
    "origin": {
      "default": "",
      "title": "Origin",
      "type": "string"
    }
  },
  "title": "launch_serverArguments",
  "type": "object"
}
run_demo
description
Run the canonical scenario and return DemoResult.
inputSchema
{
  "properties": {
    "session_id": {
      "default": "mcp-vulnerable",
      "title": "Session Id",
      "type": "string"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}
tools/list (defended)
launch_server
description
Simulate launching an MCP server through the Inspector proxy. Vulnerable mode does not check arguments. Defended mode requires admin_token + origin to match.
inputSchema
{
  "properties": {
    "session_id": {
      "default": "mcp-defended",
      "title": "Session Id",
      "type": "string"
    },
    "admin_token": {
      "default": "",
      "title": "Admin Token",
      "type": "string"
    },
    "origin": {
      "default": "",
      "title": "Origin",
      "type": "string"
    }
  },
  "title": "launch_serverArguments",
  "type": "object"
}
run_demo
description
Run the canonical scenario and return DemoResult.
inputSchema
{
  "properties": {
    "session_id": {
      "default": "mcp-defended",
      "title": "Session Id",
      "type": "string"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}
telemetry: vulnerable
[
  {
    "event_id": "evt_592ef71581284123",
    "ts": "2026-07-26T03:20:16.412923+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_037bdd9092de4240555a7de7",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  },
  {
    "event_id": "evt_49046be8655e9a4c",
    "ts": "2026-08-19T08:56:24.840702+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_037bdd9092de4240555a7de7",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  },
  {
    "event_id": "evt_51369565019a4dec",
    "ts": "2026-08-29T11:19:35.150092+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_037bdd9092de4240555a7de7",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  },
  {
    "event_id": "evt_9ff2af7b81306327",
    "ts": "2026-09-07T14:02:15.935250+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_037bdd9092de4240555a7de7",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  },
  {
    "event_id": "evt_3955701af0786eb0",
    "ts": "2026-09-07T14:02:58.956925+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_037bdd9092de4240555a7de7",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  },
  {
    "event_id": "evt_11715bb8faf858df",
    "ts": "2026-09-07T14:04:38.454845+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_037bdd9092de4240555a7de7",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  },
  {
    "event_id": "evt_f661353bc6b01f00",
    "ts": "2026-09-07T15:42:44.992339+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_037bdd9092de4240555a7de7",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  }
]
telemetry: defended
[
  {
    "event_id": "evt_566a9cb3be65dac7",
    "ts": "2026-07-26T03:20:16.413117+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  },
  {
    "event_id": "evt_6dbed9f29b560e21",
    "ts": "2026-08-19T08:56:24.840766+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  },
  {
    "event_id": "evt_32c9e502321d068e",
    "ts": "2026-08-29T11:19:35.150438+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  },
  {
    "event_id": "evt_79d03d30f1880114",
    "ts": "2026-09-07T14:02:15.935561+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  },
  {
    "event_id": "evt_f37d3b691310151f",
    "ts": "2026-09-07T14:02:58.957155+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  },
  {
    "event_id": "evt_697df563a2e7cb46",
    "ts": "2026-09-07T14:04:38.455050+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  },
  {
    "event_id": "evt_58aa829fbf415887",
    "ts": "2026-09-07T15:42:44.992768+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  }
]