Executive brief
MCP Inspector is a debugging tool for the Model Context Protocol, which developers use to interact with AI agents. The proxy server component lacks authentication controls, allowing unauthenticated attackers to send arbitrary commands over the network and execute code remotely. This could enable unauthorized users to compromise systems where the Inspector proxy is exposed.
Technical details
The vulnerability is a missing authentication check (CWE-306) between the Inspector client and the proxy server. Versions below 0.14.1 allow unauthenticated network requests to launch arbitrary MCP commands over stdio without any credentials or prior privilege elevation. The attack vector is network-based with low complexity and no special requirements, requiring only passive user interaction. An attacker can achieve remote code execution by sending crafted requests to an exposed proxy instance. The fix is available in version 0.14.1 and later.
Affected products
- Anthropic MCP Inspector below 0.14.1
Timeline
- 2025-06-13: disclosed
- 2025-06-13: patched: Version 0.14.1 released