Open-source MCP scanner mcp-witness audits PyPI, finds SSRF and DNS rebinding across six packages
didesle · reddit · 2026-10-27
A security engineer released mcp-witness, an open-source (Apache-2.0) MCP server scanner combining static analysis (15 rules over tools/list and Python/TypeScript source), a dynamic harness that confirms findings against live servers, and a capability classifier. Auditing Python MCP servers on PyPI surfaced two recurring vulnerability classes across six packages, responsibly disclosed under a 90-day embargo: outbound SSRF in URL-fetch tools that can reach the cloud metadata endpoint and return live credentials (including Anthropic's reference fetch server), and inbound DNS rebinding on local HTTP-transport servers letting any web page drive your local MCP tools — no agent or prompt injection needed. Root cause: servers assume an upstream proxy, IMDSv2, or agent judgment enforces a boundary the package never checks. Self-checks: can your fetch tools reach 169.254.169.254/reserved ranges, and do your HTTP servers reject unexpected Origins?
More from coding & agent
- No G-scale K-36 locomotive under $6k online, so he's designing one with Claude — natesiggard · 2026-10-28
- Wrap flips screen recording: logs your clicks and commands, feeds them to coding agents via MCP — therealdanvega · 2026-10-28
- Ada's agent retrieval on Cohere Embed: 77ms median latency, 4x smaller vector storage — aidangomez · 2026-10-28
- Replit launches Cloud Agents turning natural language into tested PRs, shipped 250k lines internally — amasad · 2026-10-28
- Dev: Opus 5.5 beats any human reviewer — let it review your code, not the other way around — mhmazur · 2026-10-28
- RLCD: post-training that makes a model's 90% confidence actually mean 90% accuracy — kalyan_kpl · 2026-10-28