Executive brief
PraisonAI's npm MCPServer is a TypeScript library that exposes AI model tools and resources over HTTP JSON-RPC. The HTTP server binds to all network interfaces and accepts any incoming request without authentication, allowing unauthenticated network clients to list and invoke registered server-side tools, read resources, and retrieve prompts. This could enable unauthorized access to sensitive operations and data.
Technical details
The MCPServer HTTP transport lacks authentication and authorization checks. The startHttp() method parses all incoming POST requests and forwards them directly to handleRequest() without validating an Authorization header. The handleRequest() dispatcher unconditionally processes sensitive MCP methods including tools/call, resources/read, prompts/get, and tools/list. Additionally, the http.createServer().listen(port) call binds to the unspecified address (:: on IPv6 or 0.0.0.0 on IPv4), exposing the service on all network interfaces rather than localhost. The package includes an MCPSecurity class with authentication and authorization capabilities, but it is never integrated into the HTTP request path. Affected versions 1.5.0 through 1.7.1 are vulnerable; version 1.7.2 and later include patches.
Affected products
- PraisonAI MCPServer >= 1.5.0, <= 1.7.1
Timeline
- 2026-06-18: disclosed
- 2026-06-17: patched: Fix released in version 1.7.2 and later