A security researcher who scanned 24 open-source MCP (Model-Control-Protocol) server projects uncovered a single but severe sandbox command-injection flaw that scores 9.8 on the CVSS scale. The bug lives in AgenticX, a mid-tier AI-agent framework, and lets an attacker inject arbitrary shell commands into the Docker container that runs the server.
Why MCP servers matter
MCP is the glue that lets autonomous AI agents talk to external tools—files, databases, browsers, and the like. Developers embed an MCP server in their applications to give a language model the ability to read, write, and act on real-world resources. The protocol itself is lightweight and widely adopted, but each project’s maintainers are left to secure the surrounding code.
Large-scale MCP implementations such as Cline or Aider already receive regular audits and have mature security processes. The 24 projects examined here sit in the “mid-tier” range on GitHub, with between 100 and 1,000 stars. Those repositories often prioritize rapid feature delivery over hardened code, creating a blind spot for users who assume any open-source MCP server is safe by default.
The scan
The researcher built a scanner that looked for five classic web-app attack patterns:
- Command injection
- Path traversal
- Server-Side Request Forgery (SSRF)
- SQL injection
- Sandbox escape
Running the scanner across 5,911 source files produced 94 initial alerts. After manual triage, only one alert held up as a genuine vulnerability.
Inside the AgenticX bug
AgenticX builds shell commands by interpolating user-supplied strings into Python f-strings, then passes the result directly to the container’s shell. No validation or quoting of file paths occurs. An adversarial prompt can therefore inject a semicolon or other shell metacharacter, causing the container to execute any command the attacker chooses.
The researcher patched the code by:
- Using
shlex.quote()to safely escape any path supplied by the language model. - Adding explicit checks for path-traversal patterns (
../) before constructing the command.
Re-running the scanner after the fix showed the risk level drop dramatically, confirming that the mitigation addresses the root cause.
Who wins, who loses
- AI developers who embed an MCP server into their products now have a concrete example of how a single missing sanitization step can break an entire security chain. Treat every parameter that comes from a language model as untrusted input, just as you would any external API payload.
The other side of the story
The researcher stresses that the MCP protocol itself remains sound. The flaw is not a design weakness in the wire format but a coding oversight in a specific implementation. Larger, well-audited projects have already addressed similar issues, and the open-source community can learn from the AgenticX patch. Still, the incident shows that “mid-tier” projects can harbor high-impact bugs despite modest star counts.
Takeaway
A single unchecked f-string in AgenticX turned an entire MCP server into a launchpad for arbitrary code execution. The episode proves that the security of AI-agent ecosystems hinges less on the protocol and more on disciplined implementation. Developers must treat every LLM-generated parameter as hostile, platforms should enforce runtime safeguards, and security tools need to evolve to understand the unique trust chains AI agents create.
Source: dev.to/easterndev/i-scanned-24-mcp-server-projects-and-found-a-real-sandbox-command-injection-cvss-98-4k9h