compare: MCP Inspector / devtool auth-bypass bounded RCE proof

MCP Inspector / devtool auth-bypass bounded RCE proof

MCP01MCP07tools/call

What just happened in your session

vulnerablecompare-vuln-remote-inspector-proxy-auth-bypass2026-11-06T13:27:03.581211+00:00

side effect landed in /app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt · canary CANARY_remote_inspector_proxy_auth_bypass_098b58bbb98bee3c23f95530

defendedcompare-def-remote-inspector-proxy-auth-bypass2026-11-06T13:27:03.581360+00:00

blocked by inspector_proxy_auth_policy · logged to var/telemetry.jsonl

Tool description that differed: launch_server

poisoned

Simulate launching an MCP server through the Inspector proxy. Vulnerable mode does not check arguments. Defended mode requires admin_token + origin to match.

sanitised

Simulate launching an MCP server through the Inspector proxy. Vulnerable mode does not check arguments. Defended mode requires admin_token + origin to match.

Vulnerable mode

violation_detected: truesecret_exfiltrated: false

✗ The attack succeeded

where it landed

sandbox/effects/inspector-rce-proof-<session>.txt

bounded rce proof

Artifact

/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt

Auth checked

False

Would execute

False

Note

no real subprocess; bounded proof file only

telemetry events for this run

sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode

impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt

sandbox_file_written impact-runner → sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt allowed_by_vulnerable_mode

impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt

Background

launch_server gates a privileged subprocess on an admin_token, but the default token is the literal string 'admin' and the Origin allowlist is disabled. Any caller that guesses the default token, or sends a request from a non-allowlisted origin, can spin up a privileged MCP subprocess in another session's namespace.

Defended mode

violation_detected: truesecret_exfiltrated: falseblocked_by: inspector_proxy_auth_policy

✓ The defense blocked the attack

where it landed

var/telemetry.jsonl

rule that fired

inspector_proxy_auth_policy

auth decision

Check

admin_token

Reason

missing or wrong admin token

Would execute

False

telemetry events for this run

policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked

policy.inspector_proxy_auth_policy: missing or wrong admin token

policy_decision policy.inspector_proxy_auth_policy → inspector-proxy.launch_server blocked

policy.inspector_proxy_auth_policy: missing or wrong admin token

Background

The defended path requires a non-default admin_token sourced from a Kubernetes secret, enforces the Origin allowlist, and binds the launched subprocess to the requesting session_id. Default-token, foreign-origin or cross-session launches are refused with the specific failed check.

Background on this attack class

Bounded MCP Inspector / devtool auth-bypass RCE-class demo. Inspired by CVE-2025-49596 (MCP Inspector). The vulnerable mode accepts an unauthenticated launch request and creates a bounded proof file via ``ImpactRunner.write_sandbox_file``. There is no real subprocess. The defended mode requires an admin token and a matching Origin header.

Developer view: raw outputs, tools/list, MCP Inspector

Vulnerable mount: http://mcp-sec.data.mayflower.tech/mcp/inspector-proxy-auth-bypass/vulnerable/
Defended mount: http://mcp-sec.data.mayflower.tech/mcp/inspector-proxy-auth-bypass/defended/
Open in MCP Inspector: run npx @modelcontextprotocol/inspector locally and paste either URL above as a Streamable HTTP server.

DemoResult: vulnerable

{
  "experiment": "remote-inspector-proxy-auth-bypass",
  "mode": "vulnerable",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [],
  "events": [
    {
      "type": "bounded_rce_proof",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "auth_checked": false,
      "would_execute": false,
      "note": "no real subprocess; bounded proof file only"
    }
  ]
}

DemoResult: defended

{
  "experiment": "remote-inspector-proxy-auth-bypass",
  "mode": "defended",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [
    "inspector_proxy_auth_policy"
  ],
  "events": [
    {
      "type": "auth_decision",
      "check": "admin_token",
      "reason": "missing or wrong admin token",
      "would_execute": false
    }
  ]
}

tools/list (vulnerable)

launch_server

description

Simulate launching an MCP server through the Inspector proxy. Vulnerable mode does not check arguments. Defended mode requires admin_token + origin to match.

inputSchema

{
  "properties": {
    "session_id": {
      "default": "mcp-vulnerable",
      "title": "Session Id",
      "type": "string"
    },
    "admin_token": {
      "default": "",
      "title": "Admin Token",
      "type": "string"
    },
    "origin": {
      "default": "",
      "title": "Origin",
      "type": "string"
    }
  },
  "title": "launch_serverArguments",
  "type": "object"
}

run_demo

description

Run the canonical scenario and return DemoResult.

inputSchema

{
  "properties": {
    "session_id": {
      "default": "mcp-vulnerable",
      "title": "Session Id",
      "type": "string"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}

tools/list (defended)

launch_server

description

Simulate launching an MCP server through the Inspector proxy. Vulnerable mode does not check arguments. Defended mode requires admin_token + origin to match.

inputSchema

{
  "properties": {
    "session_id": {
      "default": "mcp-defended",
      "title": "Session Id",
      "type": "string"
    },
    "admin_token": {
      "default": "",
      "title": "Admin Token",
      "type": "string"
    },
    "origin": {
      "default": "",
      "title": "Origin",
      "type": "string"
    }
  },
  "title": "launch_serverArguments",
  "type": "object"
}

run_demo

description

Run the canonical scenario and return DemoResult.

inputSchema

{
  "properties": {
    "session_id": {
      "default": "mcp-defended",
      "title": "Session Id",
      "type": "string"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}

telemetry: vulnerable

[
  {
    "event_id": "evt_c6531556e79c05ad",
    "ts": "2026-11-06T13:11:03.149747+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_098b58bbb98bee3c23f95530",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  },
  {
    "event_id": "evt_4cf502045211964b",
    "ts": "2026-11-06T13:27:03.581211+00:00",
    "session_id": "compare-vuln-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_inspector_proxy_auth_bypass_098b58bbb98bee3c23f95530",
      "artifact": "/app/sandbox/effects/inspector-rce-proof-compare-vuln-remote-inspector-proxy-auth-bypass.txt"
    }
  }
]

telemetry: defended

[
  {
    "event_id": "evt_56ecab3ed761f47c",
    "ts": "2026-11-06T13:11:03.150254+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  },
  {
    "event_id": "evt_dbc476a7f2914a04",
    "ts": "2026-11-06T13:27:03.581360+00:00",
    "session_id": "compare-def-remote-inspector-proxy-auth-bypass",
    "experiment": "remote-inspector-proxy-auth-bypass",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.inspector_proxy_auth_policy: missing or wrong admin token",
    "data": {
      "actor": "policy.inspector_proxy_auth_policy",
      "target": "inspector-proxy.launch_server",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "missing or wrong admin token"
    }
  }
]