FlowSentry MCP Security Report

FS-MCP-001  CRITICALMCP handshake accepted without authentication

Why it matters. The server completes the standard MCP initialize handshake — returning protocol capabilities and server identity — to any anonymous caller. Authentication is deferred or absent at the transport level, so anyone can enumerate and often invoke the server's tools.

Recommendation. Put the MCP endpoint behind OAuth 2.1 (per the MCP authorization spec) or, minimally, scoped bearer tokens. Reject unauthenticated handshakes with 401 and a WWW-Authenticate header.

44 of 100 scanned servers (44%) are affected, across 40 distinct hosts.

Verification: all 44/44 findings were re-confirmed in a second independent scan pass, and a sample was additionally validated with a separate HTTP client (curl) showing full JSON-RPC serverInfo responses returned without any credential.

FS-MCP-003  MEDIUMMissing HTTP Strict-Transport-Security (HSTS)

Why it matters. Without an HSTS policy, the very first request to the host can be downgraded to plain HTTP by a man-in-the-middle (SSL stripping).

Recommendation. Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every response.

61 of 100 scanned servers (61%) are affected, across 55 distinct hosts.

FS-MCP-004  MEDIUMMissing Content-Security-Policy

Why it matters. No CSP header is sent. For API-only JSON responses the direct impact is limited, but error pages, docs routes and any HTML rendering have no injection mitigation layer.

Recommendation. Add a Content-Security-Policy; default-src 'self' is a safe baseline for API servers.

86 of 100 scanned servers (86%) are affected, across 79 distinct hosts.

FS-MCP-006  MEDIUMWildcard CORS (Access-Control-Allow-Origin: *)

Why it matters. The endpoint tells every website a visitor opens that it may read responses cross-origin. Combined with an unauthenticated endpoint, this lets any web page interact with the MCP server from a victim's browser.

Recommendation. Echo only known-needed origins instead of *; for MCP endpoints usually no browser origin is required at all.

27 of 100 scanned servers (27%) are affected, across 26 distinct hosts.

FS-MCP-007  MEDIUMMissing X-Content-Type-Options: nosniff

Why it matters. Browsers may MIME-sniff responses, which can turn an attacker-influenced response body into executable content in some embedding contexts.

Recommendation. Send X-Content-Type-Options: nosniff on all responses.

70 of 100 scanned servers (70%) are affected, across 63 distinct hosts.

FS-MCP-005  LOWDetailed build/version disclosure to anonymous clients

Why it matters. The handshake response discloses exact server product and build version before any authentication, easing targeted attacks against specific versions.

Recommendation. Consider returning full version detail only to authenticated clients.

44 of 100 scanned servers (44%) are affected, across 40 distinct hosts.

FS-MCP-010  LOWAdvertised endpoint unreachable (DNS or timeout)

Why it matters. The remote endpoint published in the official registry did not resolve in DNS or did not answer within the scan window. Clients integrating this server will fail; stale entries also hide takeover risks (dangling DNS).

Recommendation. Verify the published URL, fix or remove the registry entry.

6 of 100 scanned servers (6%) are affected, across 3 distinct hosts.