Two MCP server advisories, and what to check in yours.

What we found

persistent-terminal-mcp. Its REST API for terminal sessions has no authentication, allows requests from any origin, and listens on all network interfaces. Anyone who can reach that port can create, write to, read and kill terminal sessions. Read the persistent-terminal-mcp advisory.

fetcher-mcp. Its HTTP transport has no authentication. It listens on localhost by default and is reachable from the network when the operator sets --host=0.0.0.0, which the project's README documents. Its fetch_url and fetch_urls tools check that a URL uses http or https and nothing else, so loopback, private-range and link-local addresses are accepted. Another researcher reported the request-forgery issue publicly in July; we found both independently. Read the fetcher-mcp advisory.

What it means for your agent

An MCP server holds the tools your agent can use. Both findings are about who else can use them.

A server that answers on a network interface and asks for no credentials does not serve only your agent. Anyone who can reach the port gets the same tools.

A fetch tool goes wherever its URL points, and the model picks the URL from what it has read. A web page or a document the agent was asked to summarise can supply it. Without a destination check, that URL can name an address inside your network that the agent's host can reach and the author of the page cannot. That is indirect prompt injection meeting a tool with no limits.

What to check in your own servers

• Where each server listens. You want 127.0.0.1 or localhost unless you mean otherwise. A Node server that calls listen without a host argument binds to all network interfaces.
• Whether its HTTP transport asks for credentials. If it does not, binding to localhost is the only thing keeping other hosts out, and a flag like --host=0.0.0.0 takes that away.
• Its CORS policy. origin: '*' accepts requests from any web origin.
• What each fetch tool refuses. Checking for http or https is not a destination check. Loopback, private-range and link-local addresses should be refused, judged by the address the hostname resolves to, and again on every redirect.
• Whether you run either package. Each advisory lists the versions it affects.

If you want a second reader

This is the work Stonepath IT does: we test the servers and tools your agents can reach, against a target you authorize, and you keep the report and the test suite. It starts with a 20-minute call to size it.

Book a 20-minute call