AutoJack MCP WebSocket Upgrade to Localhost from Non-Loopback Origin

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects WebSocket upgrade requests targeting Multi-Context Protocol (MCP) endpoints on AutoGen Studio default ports (8080/8081). It specifically flags connections originating from non-loopback addresses where the HTTP Origin header does not contain expected local indicators ('localhost', '127.0.0.1', '::1'), which may indicate unauthorized cross-origin access or remote exploitation attempts against the local development environment.