Skip to content
OpenAdvisories

Product · universal-tool-calling-protocol

python-utcp

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2026-101057

    utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL

    utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensure_secure_url validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loop…

    universal-tool-calling-protocol python-utcp