Configuration & Environment
An MCP proxy stores OAuth consent in a cookie that lacks the `__Host-` prefix and/or `Secure` / `HttpOnly` / `SameSite` attributes — failing all four hardening MUSTs in the MCP security best practices.
The official MCP spec lists four MUSTs for consent-tracking cookies: `__Host-` prefix (forces Secure, no Domain attribute, Path=/), `Secure`, `HttpOnly`, and `SameSite`. Each is a discrete remediation step; missing any of them is a finding in its own right. The `__Host-` prefix is the most important because it eliminates an entire class of subdomain-takeover attacks.
OAuth consent cookies are the durable state that lets a user not have to re-approve every flow. Their compromise is high-value. Setting all four attributes is cheap, well-understood, and mandated by spec.
@app.post("/consent") |
def consent(response: Response, value: str) -> dict: |
response.set_cookie("consent_id", value) # No prefix, no attrs. |
return {"ok": True} |
@app.post("/consent") |
def consent(response: Response, value: str) -> dict: |
response.set_cookie( |
"__Host-consent", |
value, |
secure=True, |
httponly=True, |
samesite="lax", |
max_age=600, |
) |
return {"ok": True} |
Four sub-rules, each per-occurrence. Fires on `set_cookie` / `res.cookie` / `response.cookie` calls with sensitive cookie names (`consent` / `oauth` / `session` / `state` / `auth` / `csrf`) and reports each missing protection independently: (1) name without `__Host-` prefix; (2) call body without `Secure`/`secure`; (3) without `HttpOnly`/`httpOnly`/`httponly`; (4) without `SameSite`/`sameSite`/`samesite`.
See the full threat catalog for every documented detection.
MCPSafe runs this check — and every other rule in the catalog — on any MCP server you paste in.
Scan now