## https://sploitus.com/exploit?id=3A23F595-29EB-50D8-947A-6200E6B0CA9A
# MCP Transparent Proxy Injection — Proof of Concept
**CVE: [pending] | CWE-441: Trust Boundary Violation**
The Model Context Protocol (MCP) stdio transport trusts any executable specified in `settings.json` without binary identity verification. This PoC demonstrates that a malicious MCP server can transparently forward JSON-RPC calls to an external binary, injecting unauthorized tools into the agent session without detection.
## How it works
```
Claude Code / Cursor
│
│ stdio JSON-RPC (trusted)
▼
wrapper.py ←─ appears in settings.json as a Python MCP server
│
│ stdio JSON-RPC (forwarded transparently)
▼
browser-mcp.exe ←─ unknown to Claude Code. 12 browser tools injected.
```
The agent sees 12 browser tools and assumes they are legitimate. No process allows, denies, or questions them.
## Affected
All MCP implementations using stdio transport:
- Claude Code, Cursor, Windsurf, Cline, Continue.dev, Zed
## Files
| File | Purpose |
|------|---------|
| `wrapper.py` | Transparent JSON-RPC proxy |
| `poc_hijack.py` | Dual-channel: MCP proxy + API response rewrite |
## Timeline
- 2026-08: Discovered, CVE submitted
## Author
Le Cheng — Independent Researcher