MCP Inspector CVE-2025-49596 Vulnerability Checker

This script checks if an MCP Inspector server is vulnerable to CVE-2025-49596, a security issue where the /sse endpoint responds to unauthenticated requests (missing auth token).

How It Works

• The script sends a GET request to the /sse endpoint of the target MCP Inspector server.
• It checks the response:
  • If the server responds with HTTP 200 (OK) without requiring an auth token, it is likely vulnerable.
  • If the server responds with HTTP 401 (Unauthorized), it is likely patched (v0.14.1+).
  • Other responses are reported as unexpected.

Requirements

• Python 3.x
• requests library (pip install requests)

Usage

Run the script from the command line:

python MCP-Inspector-vulncheck.py [host]

• host (optional): The hostname or IP address of the MCP Inspector server (default: localhost).