How the attack works
When mcp-remote connects to an MCP server, it retrieves OAuth metadata that includes an authorization_endpoint URL. mcp-remote inserts this URL into a shell command without sanitising it. An attacker who controls the MCP server puts shell metacharacters such as $(), backticks, semicolons, pipes, && or $IFS inside the URL. When mcp-remote processes the metadata, those characters are interpreted by the shell and run as arbitrary commands on the client host, not just as part of a URL.
Why it matters
An attacker who controls or spoofs an MCP server can get arbitrary command execution on any machine that connects to it with mcp-remote, giving them a foothold to steal data, credentials, or pivot further into the network.
What you can do
- Only connect mcp-remote to MCP servers you trust and control; treat third-party or community servers as untrusted input.
- Inspect OAuth metadata responses (especially authorization_endpoint) for shell metacharacters before allowing automated processing.
- Run mcp-remote in a sandboxed or least-privilege environment so command execution cannot reach sensitive data or credentials.
- Monitor outbound connections and process launches triggered by mcp-remote for unexpected shell commands.
Known benign look-alikes
- Legitimate OAuth metadata documentation describing endpoint discovery for educational purposes.
- Security tooling that parses authorization_endpoint for vulnerability scanning.