Visiting a web page could compromise developers running MCP Inspector

Developers who ran Anthropic's MCP Inspector, a tool for testing Model Context Protocol servers, were exposed to remote code execution by simply visiting a malicious web page, Oligo Security disclosed in July 2025. The flaw was assigned CVE-2025-49596 and a CVSS score of 9.4.

MCP Inspector consists of a browser interface and a local proxy that talks to MCP servers. Oligo found that the proxy accepted commands from any origin and did not require authentication. Combined with a long-standing browser behaviour that lets web pages send requests to the address 0.0.0.0, a page could reach the proxy on the developer's machine and instruct it to launch an MCP server with an arbitrary command.

Oligo demonstrated the attack against default installations and noted that the inspector was often left running in the background. Because MCP servers are typically launched with the developer's user privileges and environment, a successful exploit could reach the developer's credentials and files.

Anthropic fixed the issue in version 0.14.1, released in June 2025, by adding a session token that the browser interface must present and by validating request origins. Users were advised to upgrade and to avoid exposing the inspector to the network.

The disclosure came amid a run of vulnerabilities in the MCP tooling ecosystem, including issues in the mcp-remote client and in filesystem servers, as the protocol's rapid adoption outpaced security review of its reference implementations.