Server accepts spoofed Origin header
A tools/list call with Origin: https://attacker.example got a 2xx response.
What it means
patchbay sent a probe with a bogus Origin header. The server didn't reject it. This matters for servers that are intended to be called from browser clients: a user who visits https://attacker.example could trigger tool calls on their behalf (DNS rebinding, CSRF). For server-to-server MCP endpoints (called by stdio or server-side HTTP) Origin validation is not required, so this finding is low severity by default. If you don't accept browser clients, you can ignore it.
How to fix
Validate the Origin header against an allowlist of expected client origins. Reject requests with unknown or missing Origin on state-changing operations.
Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.