Connecting an AI client to a remote Model Context Protocol (MCP) server could run arbitrary code on the developer’s machine. That is the practical effect of CVE-2025-6514, a critical vulnerability disclosed on July 9, 2025 in the npm package mcp-remote, a community OAuth proxy that lets local MCP clients reach remote MCP servers. The flaw carried a CVSS score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Affected versions ran from 0.0.5 through 0.1.15, with the fix shipping in 0.1.16. The package had been downloaded more than 400,000 times, so the exposed population was broad, covering the AI desktop applications and code editors that rely on mcp-remote to reach remote servers.
When mcp-remote begins an OAuth flow with a remote server, that server returns authorization metadata, including an authorization_endpoint value. Vulnerable versions of the proxy passed that server-supplied string to the operating system’s URL and protocol handler without validating it. The crafted authorization_endpoint response was therefore consumed as input to a system command, producing OS command injection and remote code execution with the running user’s privileges. On Windows the protocol-handler invocation reached a shell through command-subexpression syntax, which made the outcome reliable on that platform. The trigger was ordinary OAuth metadata that the proxy trusted.
Trust model
When you point an AI client at a remote MCP server, you extend host-level execution trust to whoever operates that server. The client and any proxy in front of it act on what the server returns, executing it on your machine rather than displaying it. mcp-remote was a legitimate, well-intentioned proxy written to make remote MCP servers easier to use. It still became a path to remote code execution the instant a server returned a hostile value, because the architecture already assumed the server was honest.
The trust boundary that should sit between your host and a remote third party is where data crosses constantly by design. An MCP server exists to return protocol metadata and tool results that the client will act on. Every one of those return values is data you did not author, arriving from a system you do not control. One missing validation step on that data was enough to turn a connection into code execution.
The bigger risk is a server that is hostile by design
CVE-2025-6514 was an accident. The maintainers did not intend for a server response to reach a shell, and they shipped a fix once the issue was reported.
A threat actor who operates an MCP server on purpose does not need a flaw in trusted client-side code. The server sits on the far side of the trust boundary by design, returning whatever data reaches an execution path the client or its proxy exposes. Nothing about these servers has to be vulnerable, because the server is the attacker. They need only a victim willing to connect and act on what comes back, which is the normal operating mode of an MCP client.
Malicious servers keep growing in number because deploying one is cheap, and a single adversary can run many under different names, taking them down and republishing as needed. Patching a proxy addresses one class of accidental flaw but does nothing against a server that was hostile from its first commit.
You also cannot code-review a remote MCP server. Its logic runs on infrastructure controlled by someone else, and the response it returns to you at connection time can differ from the response anyone else receives. The usual supply-chain habit of reading code before trusting it does not apply when the code is remote and the adversary decides what it does.
What a defender can do
Treat every MCP server you do not operate as untrusted third-party code with a path to your host, because in effect that is what it is. Running AI clients and their proxies under least privilege limits what a hostile response inherits, and keeping proxy components like mcp-remote patched neutralizes this class of server-supplied input. Whether a given server is hostile before you connect is an intelligence problem that patching and privilege-scoping do not answer.
Where Aephix fits
CVE-2025-6514 was accidental and got patched. Hostile MCP servers are what scale, and no version bump removes them. Aephix Vantage lets you check a server for free before you connect, and Aephix Sleuth links a flagged server to the operation behind it, so you know which other names the same adversary runs.