What happened
mcp-remote's device-code OAuth flow sends client secrets and receives tokens without enforcing HTTPS on the discovered endpoint URLs. If a remote MCP server advertises non-loopback http authorization/token endpoints, the credentials and resulting tokens traverse the network in cleartext and can be captured by an on-path attacker.
Why it matters
MCP clients authenticate against remote tool servers with OAuth tokens that grant the agent access to that server's data. Leaking the client secret and refresh token in cleartext gives an attacker durable impersonation of the MCP connection — full read/write access to everything the server exposes to the agent.
Attack vector
authorizeWithDeviceCode does not enforce HTTPS for discovered device authorization and token endpoints. When those non-loopback endpoints are http URLs, an on-path attacker captures the client secret and issued access/refresh tokens sent over the wire.
Affected systems
mcp-remote 0.8.0 through 0.14.3 (authorizeWithDeviceCode)
Mitigation
Upgrade mcp-remote beyond 0.14.3 and/or enforce HTTPS endpoints in OAuth configuration (VulnCheck advisory; punkpeye/mcp-remote).