An attacker positioned on the network path between the agent host and the catalog registry can intercept the cleartext HTTP response and modify the provided command and args fields. Since the default configuration for mcp_allow_fn is None, the agent does not restrict which commands are executed upon resolution. This vulnerability affects all versions of atomic-agents-stack through 1.0.0. The impact is significant as it allows arbitrary code execution on the agent host without requiring LLM-level interaction.

Impact

Successful exploitation allows an unauthenticated network attacker to achieve remote code execution on the host running the atomic-agents-stack. This bypasses security expectations by executing commands defined by an untrusted remote catalog, potentially leading to full system compromise or lateral movement within the environment.

Recommendation

• Update atomic-agents-stack to a patched version that mandates HTTPS and enforces explicit opt-ins for HTTP registry URLs.
• Implement a mandatory allowlist function for mcp_allow_fn to validate the basename of any command resolved from external registry sources before subprocess spawning.
• Restrict network egress for agent hosts to only trusted, HTTPS-enabled registry endpoints to mitigate the risk of MITM interception of catalog responses.