cfgaudit

Rules / CFG018

CFG018 MCP server binds to all network interfaces (NeighborJack)

Severity: warn OWASP: LLM03:2026 – Excessive Agency OWASP MCP: MCP07:2025 – Insufficient Authentication & Authorization — provisional (MCP Top 10 v0.1)

What cfgaudit checks

cfgaudit flags any MCP server — in settings.json (mcpServers) or the project's .mcp.json — that binds to all network interfaces. The bind address is detected in either:

All-interfaces addresses recognised: IPv4 0.0.0.0, bracketed IPv6 [::], and the bare IPv6 unspecified address ::. Real networks such as 10.0.0.0 are not matched.

Binding to 0.0.0.0 makes a server intended for local use reachable by anyone on the same LAN or network segment — coffee-shop Wi-Fi, a shared office VLAN, a cloud subnet. Security researchers dubbed this "NeighborJack"; in an analysis of 7,000+ MCP servers it was the single most common misconfiguration.

Trigger example

{
  "mcpServers": {
    "custom": {
      "command": "mcp-server",
      "env": {
        "HOST": "0.0.0.0",
        "PORT": "3000"
      }
    }
  }
}

Safe alternative

Bind to loopback only:

{
  "mcpServers": {
    "custom": {
      "command": "mcp-server",
      "env": { "HOST": "127.0.0.1", "PORT": "3000" }
    }
  }
}

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation