DeepSeek MCP Server Unauthenticated HTTP Transport Exposure

Technical Analysis

The vulnerability stems from `createMcpExpressApp` being invoked without an `authProvider` and no middleware enforcing access control on the `POST /mcp` route, meaning the MCP session initialization handshake is fully open to any client that can reach the port. An attacker who can reach the exposed port (default 3000, enabled by default in the Dockerfile/docker-compose assets) can perform the `initialize` MCP handshake, obtain a valid session ID, and then call tools like `deepseek_sessions` and `deepseek_chat` with no credentials of their own. Because `deepseek_chat` uses the server-side `DEEPSEEK_API_KEY` when configured, this crosses a trust boundary: an external, unauthenticated actor gains the ability to consume a privileged, operator-held API credential through the MCP tool-calling interface. This is distinct from the hosted BYOK endpoint, which correctly enforces Bearer token auth, highlighting that the flaw is specific to the self-hosted deployment path where authentication was omitted entirely.

Affected Systems

@arikusi/deepseek-mcp-server; protocols: MCP

Detection Signatures

• Unauthenticated POST requests to /mcp endpoint followed by successful 'initialize' responses
• Requests to /mcp lacking Authorization header on self-hosted deployments
• Unexpected invocations of deepseek_sessions or deepseek_chat tools from unrecognized source IPs
• Unusual spikes in DEEPSEEK_API_KEY usage/billing not correlated with known client sessions
• Exposed port 3000 reachable from untrusted networks on hosts running this MCP server

Remediation Steps

1. 1

   Upgrade to version 1.8.0 or later

   Apply the upstream patch that introduces authentication enforcement on the MCP HTTP transport.

2. 2

   Restrict network exposure

   Do not expose port 3000 (or the configured MCP HTTP port) to untrusted networks; bind to localhost or place behind a VPN/firewall/reverse proxy with authentication.

3. 3

   Enforce authProvider on self-hosted deployments

   Ensure `createMcpExpressApp` is configured with a valid authProvider and middleware that validates credentials before allowing session initialization.

4. 4

   Rotate and scope API keys

   Rotate any DEEPSEEK_API_KEY that may have been exposed via unauthenticated access, and use keys scoped with minimal privileges and rate/cost limits.

5. 5

   Audit deployment defaults

   Review Dockerfile and docker-compose defaults that enable HTTP mode and expose ports by default; harden default configurations to require explicit opt-in for network exposure.