MCP stdio transport RCE

What happened

Most local MCP servers speak over stdio: the client spawns the server as a child process and exchanges JSON-RPC on stdin and stdout. It is the default transport because it needs no ports and no network trust.

OX Security reported a remote-code-execution class of flaw in how that transport was handled across several agent clients, Cursor, VS Code, Windsurf, and Claude Code. Message handling that should have stayed inside the protocol reached process execution instead.

The severity comes from ubiquity rather than sophistication. This is not one bad MCP server. It is the pipe underneath the working set of MCP servers on a developer machine, in clients that update on their own schedules.

Why this surface is different

An engineer can audit the MCP servers they chose to install. They cannot audit the transport those servers arrive on, and they usually cannot say which client versions are running across the fleet. Agent clients auto-update, so "which version is deployed" is a genuinely unknown quantity in most organisations, which is the inventory gap before it is a vulnerability.

What a Sekeye campaign does

The template treats the client, not the server, as the affected artefact:

1. Agents report installed agent-client versions per host, Cursor, VS Code and its agent extensions, Windsurf, Claude Code, across laptops and servers.
2. Version-range matching flags hosts running an affected client build, with the count of MCP servers configured on each so remediation can be ordered by actual exposure rather than headcount.
3. Findings reconcile automatically once a host reports an updated client, so the closure evidence is a by-product of the next inventory snapshot.

Allowed-tools enumeration and an optional inline MCP proxy are roadmap items under the Govern phase. Today the agent reports; it does not sit in the path.

Rotation guidance

Code execution in the agent client means the agent's context was reachable. Rotate source-control tokens, cloud CLI credentials, and any provider API keys held in the developer's environment. Update the client before re-enabling MCP servers that were configured on an affected host.

Confirmed against public reporting

OX Security documented an architectural weakness in MCP's stdio transport, which launches servers as local child processes and reads their capabilities from standard output. By controlling content an AI IDE renders, a crafted page, a README in a browsed repository, or a malicious tool description from a remote server, an attacker could get the IDE to silently register a malicious stdio server in the local MCP config.

Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI were all affected. Windsurf (CVE-2026-30615) was the most severe: exploitation needed no user interaction beyond the IDE opening attacker-controlled content. Anthropic confirmed the stdio execution model is by design and declined to change the protocol, placing sanitisation on the developer.