Executive brief
MCPJam inspector is a local-first development platform for MCP servers that listens on all network interfaces by default. Versions 1.4.2 and earlier contain a critical flaw that allows an attacker to send a simple HTTP request to the /api/mcp/connect endpoint to execute arbitrary commands on the system running MCPJam inspector, requiring no user interaction or authentication. This gives an attacker complete control over the developer's machine, potentially compromising sensitive code, credentials, and project data.
Technical details
MCPJam inspector contains a missing authorization/input validation vulnerability (CWE-306) in the /api/mcp/connect HTTP endpoint. The root cause is that the application binds to 0.0.0.0:6274 by default (instead of localhost) and accepts HTTP POST requests to /api/mcp/connect without any authentication or input validation. When a request is received, the system directly extracts the "command" and "args" fields from the JSON payload and executes them via a spawned process, allowing unauthenticated remote code execution. The attack requires only network reachability to the HTTP endpoint and a single HTTP POST request with a crafted JSON payload; no user interaction or privileges are required. An attacker can achieve full code execution with the privileges of the MCPJam inspector process. The vulnerability is patched in version 1.4.3 or later.
Affected products
- MCPJam @mcpjam/inspector 1.4.2 and earlier
Timeline
- 2026-01-16: disclosed
- 2026-01-16: patched: Fixed in version 1.4.3