Executive brief
MCP Inspector is a local development tool used to debug and test Model Context Protocol servers. When a developer connects the Inspector to an untrusted MCP server, a malicious server can send a crafted redirect URL that injects malicious scripts into the Inspector's web interface. An attacker can exploit this to execute arbitrary commands on the developer's machine through the Inspector's built-in proxy mechanism.
Technical details
The vulnerability is a Cross-Site Scripting (XSS) flaw (CWE-79, CWE-84, CWE-94) in how MCP Inspector handles redirect URLs returned by remote MCP servers. When connecting to an untrusted server, an attacker can craft a malicious redirect URI that injects JavaScript code into the Inspector's context. This injected script can interact with the Inspector's built-in proxy to trigger arbitrary command execution on the developer's local machine. The attack requires user interaction (the developer must connect to an attacker-controlled server) but does not require any privileges. The vulnerability affects all versions prior to 0.16.6, which implements hardened URL handling and validation to prevent script execution.
Affected products
- Anthropic MCP Inspector < 0.16.6
Timeline
- 2025-09-08: disclosed
- 2025-09-08: patched: Version 0.16.6 released with fixes