Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional --mcp-http mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and logging. In the described platforms/shared/desktop/mcp/mcp_transport.h transport, the socket binds INADDR_ANY, normally on port 7777, and POST requests to /mcp reach dispatch without Authorization, Host, or Origin checks. Responses and OPTIONS advertise Access-Control-Allow-Origin: *. A peer can initialize an MCP session and invoke exposed emulator/debugging operations; even a garbage bearer token does not block dispatch, while a loopback-bind negative control prevents network access. The reported…