cfgaudit

Rules / CFG017

CFG017 MCP server sets dangerouslyAllowBrowser: true

Severity: error OWASP: LLM03:2026 – Excessive Agency OWASP MCP: MCP05:2025 – Command Injection & Execution — provisional (MCP Top 10 v0.1) CVE: CVE-2025-49596 (CVSS 9.4)

What cfgaudit checks

cfgaudit flags any MCP server — in either settings.json (mcpServers) or the project's .mcp.json — whose definition sets dangerouslyAllowBrowser: true.

With this flag the MCP server accepts requests that originate from a web browser. A browser sends requests with no custom headers and a forgeable Origin, so the server cannot tell a legitimate local client from a malicious web page. Combined with DNS rebinding — where an attacker-controlled domain re-resolves to 127.0.0.1 after the page loads — any website the user visits can reach the server on localhost.

This is exactly the chain behind CVE-2025-49596: the Anthropic MCP Inspector shipped with browser requests allowed, letting any visited site reach the local Inspector and achieve unauthenticated remote code execution with filesystem access.

Trigger example

{
  "mcpServers": {
    "inspector": {
      "command": "npx",
      "args": ["@modelcontextprotocol/inspector@1.0.0"],
      "dangerouslyAllowBrowser": true
    }
  }
}

Safe alternative

Remove dangerouslyAllowBrowser: true. If browser integration is genuinely required, bind the server to a loopback-only interface and have it enforce strict Origin / session-token checks so a rebinding page cannot impersonate a local client.

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation