medium
MCP server container shares the host network
The container runs with --network host.
Why it matters
The server can reach every service listening on your machine, including ones bound to localhost that assume only you can reach them.
How to fix it
Use the default bridge network and publish only the ports that are needed.
Before
{
"mcpServers": {
"tools": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"--network",
"host",
"acme/mcp-tools:1.4.0"
]
}
}
}After
{
"mcpServers": {
"tools": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"acme/mcp-tools:1.4.0"
]
}
}
}Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.
Other checks
- Secret written into an MCP config
- Secret passed as a command-line argument
- Secret inside an MCP server URL
- Remote MCP server over unencrypted http
- Remote MCP server with no credentials configured
- Unpinned MCP server package or image
- MCP server installs without asking (npx -y)
- MCP server container runs --privileged
- Broad host folder or Docker socket mounted into an MCP container
- MCP filesystem server with access to a very broad path
- MCP server launched through a shell
- MCP server that can run shell commands
- MCP tools auto-approved or always allowed