Executive brief
@arikusi/deepseek-mcp-server is a Node.js package that provides Model Context Protocol (MCP) integration with the DeepSeek AI API. In self-hosted HTTP mode, the service exposes an unauthenticated endpoint that allows any network user to create sessions and invoke tools—including chat functionality that consumes server-side API credentials. Attackers with network access can enumerate available tools, trigger local operations, and potentially incur unauthorized API costs on configured DeepSeek accounts.
Technical details
The vulnerability is an authentication bypass in the HTTP transport layer (src/transport-http.ts). The createMcpExpressApp function is instantiated without an authProvider parameter, and the POST /mcp route handler lacks authentication middleware. Any HTTP client sending an isInitializeRequest can obtain a valid MCP session ID and subsequently invoke any exposed tool (deepseek_sessions, deepseek_chat) without credentials. The deepseek_chat tool's handler uses the server-side DEEPSEEK_API_KEY environment variable when configured, meaning unauthenticated sessions can trigger billable API operations. Affected versions are 1.4.2 through 1.7.x; the upstream Dockerfile and docker-compose.yml enable HTTP mode by default and publish port 3000 to 0.0.0.0, maximizing default exposure.
Affected products
- arikusi @arikusi/deepseek-mcp-server >=1.4.2, <1.8.0
Timeline
- 2026-08-25: disclosed: Advisory published on GitHub Advisory Database
- 2026-06-14: patched: Version 1.8.0 released with fix