PraisonAI MCP Server Missing Default Authentication (Unauthenticated Tool Access)

Technical Analysis

The PraisonAI CLI's 'mcp serve --transport http-stream' command only enforces Authorization/Bearer header checks when an --api-key is explicitly supplied; the default is None, leaving the endpoint open. Because Origin header checks are also not enforced, an unauthenticated remote or local network client can initialize an MCP session, call tools/list to enumerate capabilities, and tools/call to invoke arbitrary registered tools. The dispatcher further forwards call arguments directly to tool handlers without validating them against the declared inputSchema, so downstream tool logic may receive unexpected or malicious parameter shapes, increasing the chance of injection, path traversal, or logic-abuse bugs in tool implementations. The blast radius is limited by the safe 127.0.0.1 bind default, but any operator who binds to 0.0.0.0 (common in containerized or cloud deployments) exposes the full tool surface to unauthenticated network attackers, crossing the trust boundary between the MCP protocol layer and the underlying agent/tool execution layer.

Affected Systems

PraisonAI; protocols: MCP

Detection Signatures

• MCP requests to /mcp or http-stream endpoints lacking an Authorization header
• Absence of Origin header validation in server logs
• tools/list or tools/call requests from unauthenticated/unexpected source IPs
• PraisonAI process launched with --transport http-stream and --host 0.0.0.0 without --api-key
• Tool-call payloads with fields not matching the tool's inputSchema

Remediation Steps

1. 1

   Upgrade PraisonAI

   Update to PraisonAI 4.6.78 or later where authentication defaults and schema validation are fixed.

2. 2

   Always set an API key

   Explicitly configure --api-key (or equivalent auth mechanism) whenever running the MCP HTTP-stream server, even in test/dev environments.

3. 3

   Restrict network binding

   Keep the server bound to 127.0.0.1 unless remote access is required; if remote access is needed, place it behind a reverse proxy or VPN with its own authentication.

4. 4

   Validate tool inputs independently

   Add server-side or tool-level validation of arguments against inputSchema regardless of dispatcher behavior, to prevent malformed calls from reaching handler logic.

5. 5

   Enforce Origin/CORS checks

   Add Origin header validation and CORS restrictions at the proxy or server layer to reduce cross-origin abuse even if API key is later enabled.

6. 6

   Monitor MCP access logs

   Alert on tools/list and tools/call requests without valid Authorization headers or from unexpected network ranges.