MCP Transport-Layer Exploitation
Security & IdentityDescription
Transport-specific vulnerabilities in MCP client-server communication. (a) `stdio` transport: command-line argument injection when the server is launched with user-controlled args (`mcp-server --config $USER_INPUT`). (b) `SSE` transport: server-sent event replay or tampering between long-poll connections. (c) `streamable HTTP` transport: HTTP response smuggling or header injection. Crosscuts ZYR-TR-008 (RCE) at the protocol-stack level rather than at the tool level.
Agent client launches `mcp-server-fs --root $USER_PATH`. Adversary supplies `/tmp/safe; rm -rf $HOME` as the path. Shell metacharacters not sanitised → RCE on agent host.
Academic research including PoisonedRAG (Zhong et al.) and adversarial embedding perturbation studies has demonstrated that an adversary with write access to a vector store can manipulate retrieval outputs, but this has not been confirmed as a real-world production exploit against a deployed financial or enterprise RAG system.
Primary mitigations
- stdio: never launch MCP server with user-controlled args
- SSE: HMAC-signed event sequence numbers
- HTTP: strict request-smuggling defences + mTLS
- transport-version pinning per server
Detection signals
Unexpected process spawn arguments on stdio servers; out-of-order or duplicate event IDs on SSE; HTTP CL/TE mismatches in MCP requests