docs(mcp): show a stdio server in the passthrough example

[playb0t]

What

The MCP configuration and quick-start pages now show a local filesystem server in the command passed after --. The server name, follow-up get command, heading and description match. Both pages are updated in English and all six translations, with the documentation test constants updated.

Why

IaC Code already adds remote HTTP servers through --transport http and handles authorization through mcp auth. Those servers don't need a wrapper; the stdio example should show a local server.

How tested

uv run pytest tests/test_website_session_backup_docs.py tests/cli/test_mcp_command.py passes (139 tests), and npm run build passes for all seven locales. uv run ruff check src/ tests/ passes; uv run ty check src/ reports the same existing Windows diagnostics as before. I checked the saved CLI configurations without connecting to an MCP server or starting OAuth.

[CLAassistant]

All committers have signed the CLA.

[guima-why]

iac-code E2E 报告

提交：4e0e25111f5e4194b5dc0095f2df05f930a2b0e6 · 状态：暂停

链路阶段进展

时间为 UTC+8；预计完成时间为估算，运行中计数尚未作为通过证据。

环节	状态	开始	完成	已耗时	预计完成	最近更新	当前说明
PR 身份与触发条件核对	已完成	10-20 13:48:53	10-20 13:48:53	0s	—	10-20 13:48:53	—
改动材料采集	未开始	—	—	—	暂无法估计	—	—
Agent 安全与影响分析	未开始	—	—	—	暂无法估计	—	—
测试计划确定 / 维护者授权	未开始	—	—	—	暂无法估计	—	—
源码包准备与摘要计算	无需执行	—	10-20 13:54:36	—	—	10-20 13:54:36	本次计划无需执行
源码上传及读回校验	无需执行	—	10-20 13:54:37	—	—	10-20 13:54:37	本次计划无需执行
full 触发与排队	无需执行	—	10-20 13:54:37	—	—	10-20 13:54:37	本次计划无需执行
full 环境准备	无需执行	—	10-20 13:54:38	—	—	10-20 13:54:38	本次计划无需执行
full 用例执行	无需执行	—	10-20 13:54:38	—	—	10-20 13:54:38	本次计划无需执行
full 结果核验	无需执行	—	10-20 13:54:39	—	—	10-20 13:54:39	本次计划无需执行
live 触发与排队	无需执行	—	10-20 13:54:40	—	—	10-20 13:54:40	本次计划无需执行
live 环境准备	无需执行	—	10-20 13:54:40	—	—	10-20 13:54:40	本次计划无需执行
live 用例执行	无需执行	—	10-20 13:54:41	—	—	10-20 13:54:41	本次计划无需执行
资源清理（随用例并行）	无需执行	—	10-20 13:54:42	—	—	10-20 13:54:42	本次计划无需执行
live 结果核验	无需执行	—	10-20 13:54:42	—	—	10-20 13:54:42	本次计划无需执行
失败复盘	无需执行	—	10-20 13:49:12	—	—	10-20 13:53:07	—
最终 GitHub 报告发布	已完成	10-20 13:49:13	10-20 13:54:35	322s	—	10-20 13:54:35	网络请求等待重试
GitHub 卡点回写与请求收尾	已完成	10-20 13:49:13	10-20 13:54:35	322s	—	10-20 13:54:35	—

最近网络尝试（仅操作枚举和错误类别，不含请求地址或响应内容）：

• github.pr.get：尝试 2 次，31.95s；timeout
• github.pr.get：尝试 2 次，32.27s；timeout
• github.comments.list：尝试 2 次，31.74s；timeout
• github.comment.write：尝试 1 次，30.03s；timeout

用例集	结果	耗时	重跑 / 重跑通过	清理异常
full	未完成 / 未执行	—	—	—
live	未完成 / 未执行	—	—	—

说明：每个失败用例最多重跑一次；任一次资源清理失败或未验证均不能判通过。
复盘是待核实建议；报告只展示固定安全字段，不含内部链接或原始云日志。

[guima-why]

/aone authorize 1210bcd

[playb0t]

Thanks for the merge.

Some context on where this came from. Over the past months I researched mcp-remote, the bridge the MCP passthrough example in the iac-code docs used to launch for stdio-only clients. Five findings now have published CVE records: CVE-2026-51994, CVE-2026-51995, CVE-2026-51996, CVE-2026-51997 and CVE-2026-52001, scored by CISA at 9.1, 7.5, 9.8, 8.8 and 7.5. In controlled local tests the published CLI followed server-selected resource-metadata and authorization-server metadata URLs, including a controlled redirect; the current release, 0.15.1 of 14 October, behaved the same way when I ran it on 15 October. This reproduces the request paths documented in CVE-2026-51994 and CVE-2026-51995. The maintainer has not stated a fix since my private report on 17 February. The package had 19,935,310 npm downloads between that report and 18 October.

The spec already says this outright. The MCP Security Best Practices page lists the resource_metadata URL, the authorization_servers list and the token endpoint as discovery inputs a malicious server can control, and says MCP clients MUST consider SSRF risks when fetching OAuth-related URLs (section "Server-Side Request Forgery", in the specification since February 2026). A local bridge that runs OAuth for a stdio client is the client in that sentence.

It mattered here because the example showed npx mcp-remote without a version pin. Users following it launched whatever npm served that day, even though the passthrough already reaches a remote HTTP server on its own. That's the line the PR removes.

One more thing, since you're inside Alibaba Cloud. Two help pages still tell users to run a renamed copy of the same bridge, npx mcp-remote-alibaba-cloud: the OpenAPI MCP Server guide and the CloudControl MCP Server page. That npm package carries the mcp-remote code from the version range in the records and has had no release since April. I sent this to Alibaba Cloud support on 14 October and got a note that it was routed to the security team and the two product teams; nothing has changed on the pages since. If you can pass it to whoever owns those pages, that'd reach them faster than the support queue.

Records, advisories, reproduction evidence and the limits of each finding: https://github.com/playb0t/mcp-remote-oauth-security. The timeline since disclosure, source by source: https://playb0t.com.

If this change ends up in release notes, a line pointing users who set up before it to the records would help them, and please credit the report to Alex Gercog (playb0t). Happy to answer questions.

Alex Gercog (playb0t)