Banked 2026-07-09 from the MCP variant sweep (2026-07-08). Calibration lesson; feeds mcp-variant-sweep
Gate-0 and the general repro floor.
The sweep's flyto-class "top pick" was yzfly/mcp-python-interpreter (101 stars). A source-read of the
repo's main branch showed an HTTP/SSE transport defaulting to host=0.0.0.0 with no app-layer auth,
wired to a run_python_code tool that does in-process eval/exec -> read as "popular unauth host RCE for
anyone reaching the port." Banked as the strongest candidate.
Then the self-hosted repro (pip install + run) corrected it:
1. The published PyPI release (1.2.3, latest) is stdio-only - installed main.py is literally
mcp.run(transport='stdio') and it ignored MCP_TRANSPORT=streamable-http (no listener came up). Every
released version is stdio-only = local-by-design = NOT a network finding.
2. The 0.0.0.0 HTTP transport exists ONLY on the unreleased main branch.
3. Even on main, the MCP SDK's DNS-rebinding Host-guard is on by default (the CVE-2025-66416 fix), so
a browser pivot is blocked; only a direct network attacker setting Host: localhost reaches it.
Net: downgraded from "top pick / unauth RCE" to WEAK / not-staged. The source-read ran ~two steps ahead of real-world exposure.
A source-read of an unreleased branch overstates real exposure. Before a candidate counts as a finding,
repro the RELEASED/INSTALLED artifact - not HEAD/main on GitHub. Specifically:
- Install the published package (pip/npm/release tag) and read the ENTRYPOINT that actually ships. The
dangerous route/transport/sink must exist THERE, not just on a branch.
- For network-exposure claims, also confirm the shipping defaults don't neutralize it (here: SDK
rebinding-Host-guard default-on; elsewhere: auth-on-by-default, bind-127.0.0.1-by-default, feature-flag-off).
- Only then does "VULNERABLE-CONFIRMED" apply. This is the exposure analogue of the existing
"repro before you claim / never off a static-only run" discipline.
main/HEAD is a development surface: half-landed features, security work in flight, insecure-by-default code
that a release either gates behind a flag or never ships. This applies beyond MCP - any incomplete-fix /
port-lag / new-sink hunt where an agent reads GitHub raw main and infers exposure. The released version is
what users run; that is the thing that counts. (Also a subagent-orchestration note: a fan-out source-reader
will confidently report the main-branch shape as the shipping shape - the parent must impose the
released-version repro gate before trusting it.)
mcp-variant-sweep SKILL Gate-0 (released-version + rebinding + auth-parity).feedback_rule38_post_audit_regression_hunting (audit-date vs HEAD-date) - same "verify against the state
users actually run" family.feedback_ssrf_guard_incomplete_fix_tell / mcp-credleak-incompletefix-audit (the sibling MCP vein).