MCP Documentation Server Unauthenticated Network-Exposed Knowledge Base API

Technical Analysis

The vulnerability stems from startWebServer() in src/web-server.ts calling app.listen(PORT) without specifying a host, causing Express/Node to bind to 0.0.0.0 rather than 127.0.0.1, combined with START_WEB_UI being enabled by default. This exposes REST endpoints (GET/POST/DELETE /api/documents, /api/search-all, /api/config) with no credential check to any network-adjacent client. An attacker can enumerate and exfiltrate proprietary documents, inject malicious or misleading content into the corpus that the MCP server later serves to the AI coding agent as semantic search results, or delete legitimate documents to degrade agent accuracy. This crosses the boundary from a local developer tool into a network-facing attack surface, turning a trusted local knowledge base into an externally poisonable input channel for the LLM's context window.

Affected Systems

MCP Documentation Server; protocols: MCP

Detection Signatures

• Unexpected inbound connections to TCP port 3080 from non-localhost sources
• HTTP requests to /api/documents, /api/search-all, /api/config, or /api/documents/:id originating from external or unexpected IP ranges
• Unauthenticated POST/DELETE calls modifying the document store outside of known CI/developer workflows
• Netlisten/bind logs showing 0.0.0.0:3080 instead of 127.0.0.1:3080
• Sudden appearance of unfamiliar or anomalous documents in the knowledge base search results

Remediation Steps

1. 1

   Upgrade to 1.13.1 or later

   Apply the vendor patch which fixes the binding behavior and/or disables unauthenticated network exposure by default.

2. 2

   Bind to localhost explicitly

   Configure app.listen(PORT, '127.0.0.1') or equivalent host restriction so the Web UI/API is not reachable from other network interfaces.

3. 3

   Disable Web UI when not needed

   Set START_WEB_UI to false in environments where the web interface is not actively required, especially on shared or routable networks.

4. 4

   Add authentication to management API

   Require API keys or session-based auth on all /api/documents and /api/config endpoints regardless of network exposure, as defense in depth.

5. 5

   Network segmentation and firewalling

   Restrict access to port 3080 via host firewall rules, VPN ACLs, or container network policies to prevent lateral exposure from LAN/VM/container bridges.

6. 6

   Audit knowledge base integrity

   Review document store contents and modification logs for unauthorized inserts, deletions, or tampering following upgrade.