Remote Code Execution in atomic-agents-stack via Insecure MCP Registry

The atomic-agents-stack library, specifically the make_http_mcp_server_registry_backend_from_url function within mcp_registry/http.py, fails to enforce secure transport protocols. The implementation permits both http and https schemes when fetching MCP catalog registry entries. Because catalog entries specify command arguments that are subsequently executed as local subprocesses by MCPClientPool, this flaw creates an RCE primitive for a Man-in-the-Middle (MITM) attacker.

An attacker positioned on the network path between the agent host and the catalog registry can intercept the cleartext HTTP response and modify the provided command and args fields. Since the default configuration for mcp_allow_fn is None, the agent does not restrict which commands are executed upon resolution. This vulnerability affects all versions of atomic-agents-stack through 1.0.0. The impact is significant as it allows arbitrary code execution on the agent host without requiring LLM-level interaction.

Impact

Successful exploitation allows an unauthenticated network attacker to achieve remote code execution on the host running the atomic-agents-stack. This bypasses security expectations by executing commands defined by an untrusted remote catalog, potentially leading to full system compromise or lateral movement within the environment.

Recommendation

• Update atomic-agents-stack to a patched version that mandates HTTPS and enforces explicit opt-ins for HTTP registry URLs.
• Implement a mandatory allowlist function for mcp_allow_fn to validate the basename of any command resolved from external registry sources before subprocess spawning.
• Restrict network egress for agent hosts to only trusted, HTTPS-enabled registry endpoints to mitigate the risk of MITM interception of catalog responses.