diff --git a/src/AI/AI-MCP-Servers.md b/src/AI/AI-MCP-Servers.md
index 4f073afdb5d..772b842d504 100644
--- a/src/AI/AI-MCP-Servers.md
+++ b/src/AI/AI-MCP-Servers.md
@@ -212,6 +212,36 @@ When testing MCP development environments, look for:
 - OAuth / redirect flows that render attacker-controlled URLs inside the local UI.
 - Proxy endpoints that accept arbitrary `command`, `args`, or server configuration JSON.
 
+### Remote Process-Launch APIs Exposed Beyond Loopback
+
+Some MCP inspector/dev panels do not just proxy JSON-RPC traffic; they also expose helper endpoints that **spawn local MCP servers** from client-supplied configuration. If that HTTP API is reachable from `0.0.0.0`, reverse-proxied on a public vhost, or left unauthenticated on an internal segment, it becomes remote OS command execution.<sup>[[30]](#references)</sup>
+
+A common request shape is a `serverConfig`/`server_params` object containing `command`, `args`, and `env`, for example:<sup>[[30]](#references)[[31]](#references)</sup>
+
+```json
+{
+  "serverConfig": {
+    "command": "bash",
+    "args": ["-c", "id"],
+    "env": {}
+  },
+  "serverId": "test"
+}
+```
+
+Practical notes:
+
+- Endpoints named like `/api/mcp/connect`, `/servers/connect`, `/spawn`, or `/start` are higher risk than plain `tools/list` because they create a new local subprocess.
+- A response such as `Connection closed`, `protocol error`, or `handshake failed` may still mean **code execution already happened**: the child process ran, but it did not speak MCP after launch. Verify first with ICMP, DNS, or HTTP callbacks before moving to a shell.
+- Treat client-controlled `env`, working-directory, plugin-path, or package-install parameters as equivalent to raw `command`/`args`.
+- During audits, confirm whether the API is loopback-only, whether the reverse proxy forwards it externally, and whether authentication is enforced **before** the spawn path.
+
+Defensive priorities:
+
+- Bind inspector/dev APIs to `127.0.0.1` or a dedicated admin network.
+- Require authentication and authorization on the spawn endpoint itself.
+- Store launch definitions server-side and allowlist approved binaries; never forward raw `command` / `args` / `env` into `spawn`, `exec`, or `subprocess` calls.
+
 ### Agent-Assisted Localhost MCP Hijacking (AutoJack pattern)
 
 If an **AI browsing agent** runs on the same workstation as a privileged local MCP control plane, **localhost is not a trust boundary**. A malicious page rendered by the agent can reach `ws://127.0.0.1` / `ws://localhost`, abuse weak WebSocket trust assumptions, and turn the agent into a **confused deputy** that drives the local control plane.
@@ -500,5 +530,7 @@ Another suspicious primitive is **native-code preloading**. A skill that sets `L
 - [27] [Invariant Labs – GitHub MCP server vulnerability](https://invariantlabs.ai/blog/mcp-github-vulnerability)
 - [28] [Remote Prompt Injection in GitLab Duo](https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo)
 - [29] [GHSA-g9hg-qhmf-q45m / CVE-2025-58444 – MCP Inspector redirect XSS to command execution](https://github.com/advisories/GHSA-g9hg-qhmf-q45m)
+- [30] [REC in MCPJam inspector due to HTTP Endpoint exposes](https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6)
+- [31] [HTB Kobold: MCPJam RCE, PrivateBin LFI-to-RCE, and Docker Host Takeover](https://0xdf.gitlab.io/2026/08/01/htb-kobold.html)
 
 {{#include ../banners/hacktricks-training.md}}