MCP Inspector Malicious Redirect URI XSS Payload
This detects an attack where a malicious MCP server sends a booby-trapped redirect_uri during OAuth login instead of a normal callback link. The trap contains HTML or JavaScript code that runs inside the developer's Inspector tool when it processes the redirect.
How the attack works
A remote MCP server the developer connects to initiates an OAuth authorization flow and supplies a redirect_uri parameter. Instead of a normal URL, the parameter contains injected markup: a script tag, a javascript: URI, an inline event handler like onerror=, or a data:text/html payload. When the vulnerable MCP Inspector (versions before 0.16.6) processes this redirect, the injected code executes in the Inspector's UI, giving the attacker a foothold to interact with the local inspector proxy. This detection only sees the network request carrying the poisoned redirect_uri — it cannot see the script actually executing in the browser.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4c1e2a9d-7f3b-4a68-9c2e-1d5b8a4f6e2c
- Severity
- High
Why it matters
An attacker who controls or compromises an MCP server can run arbitrary script inside a developer's Inspector session, potentially reaching the local inspector proxy and whatever it has access to on that machine.
What you can do
- →Upgrade MCP Inspector to 0.16.6 or later.
- →Treat any MCP server you don't fully trust as a potential attacker in the OAuth flow — validate redirect_uri values server-side before use.
- →Review any matches for authorized scanner traffic (ZAP, Burp, internal red-team) before treating them as incidents.
- →Check flagged redirect_uri values for legitimate exceptions, such as javascript:void(0) placeholders in popup-based OAuth flows or asset URLs containing the word 'javascript', before escalating.
Known benign look-alikes
- Legacy OAuth/implicit-flow clients (including some Google API client libraries) that intentionally set redirect_uri=javascript:void(0) as a no-op placeholder for postMessage-based popup authentication — excluded explicitly by filter.
- Automated web security scanners (ZAP, Burp Suite, internal red-team tooling) deliberately probing an MCP server's OAuth endpoints for XSS as part of authorized testing — will legitimately match and should be reviewed, not treated as a true incident.
- A redirect_uri value that legitimately points to a file whose name contains the substring "javascript" (e.g. .../assets/javascript-sdk.js) combined with an unrelated onload= attribute elsewhere in the same query string — rare, but possible with verbose CDN asset URLs; review before escalating.