What happened
fast-agent serves its MCP agent endpoint without authentication and binds it to all interfaces on port 8000. This lets a remote unauthenticated client invoke the exposed agent tool, and — when --shell is enabled — drive the local shell-execution tool to run operating-system commands as the server user. Without --shell it still lets an attacker burn the operator's model quota and use the configured MCP tools.
Why it matters
An AI-agent framework that exposes an unauthenticated MCP surface on the network is a direct agent-execution attack path: it hands an attacker the same tools the agent uses, including a shell executor — essentially remote control of the agent host for anyone who can reach the port.
Attack vector
fast-agent serve runs an unauthenticated HTTP/MCP transport on 0.0.0.0:8000 (CWE-306 missing auth). A remote client invokes the /mcp endpoint; when started with --shell the agent can call the local execute tool, so the attacker achieves OS command execution as the server user (CWE-78).
Affected systems
fast-agent < 0.7.21 (AI-agent framework with Model Context Protocol support)
Mitigation
Upgrade to fast-agent 0.7.21.