Vulnerable MCP Servers Lab
This repository contains intentionally vulnerable implementations of Model Context Protocol (MCP) servers (both local and remote). Each server lives in its own folder and includes a dedicated README.md with full details on what it does, how to run it, and how to demonstrate/attack the vulnerability.
Do not run any of this outside a controlled lab environment.
What this repo is for
- Security training / research into common MCP server and tool-integration failure modes.
- Hands-on demos of how vulnerable MCP servers can lead to data exposure, instruction injection, supply-chain compromise, and code execution.
Safety / lab guidance
- Use a disposable VM/container and avoid using real secrets or personal data.
- Prefer running on an isolated network; several servers make outbound network calls.
- Treat all tool output and retrieved content as untrusted data.
- If you expose any server over HTTP, assume it may be reachable/abused unless you add proper controls.
Getting started
- Pick a server from the index below.
- Open its per-server README and follow the instructions there.
- Many servers include a
claude_config.jsonsnippet intended to be merged into Claude Desktop’s MCP configuration.
MCP servers in this repo
-
Filesystem Workspace Actions (path traversal + code exec): Tools for reading/writing/listing a “workspace” plus Python execution; vulnerable to naive path joining and unsandboxed code execution.
-
Indirect Prompt Injection (local stdio): Document retrieval/search that returns documents verbatim, including embedded hidden instructions.
-
Indirect Prompt Injection (remote MCP over HTTP+SSE): Network-accessible MCP server (HTTP + SSE) returning untrusted documents verbatim; models risk of connecting to untrusted remote MCP endpoints.
-
Malicious Code Execution (eval-based RCE): “Quote of the day” tool with an unsafe formatting feature that
eval()s attacker-controlled JavaScript. -
Malicious Tools (instruction injection / fabricated tool output): Appears to return status data, but injects misleading instructions and can fabricate plausible-looking incidents.
-
Namespace Typosquatting (
twittter-mcp): Demonstrates supply-chain/trust issues via a lookalike server name intended to be mistaken for a legitimate package. -
Outdated Packages (supply chain risk): Read-only system/filesystem inspection tools whose primary purpose is to demonstrate risk from outdated/deprecated/vulnerable dependencies.
-
Secrets + PII Exposure: “Utilities” tools (IP/weather/news) but with embedded sensitive values in source code and leakage via logs.
-
Wikipedia (remote, Streamable HTTP): Wikipedia search/retrieval over HTTP; returns untrusted public content without sanitization or instruction/data separation (remote-content prompt injection risk).
About Appsecco
Appsecco is a cybersecurity company specializing in product security testing, penetration testing, and security assessments. We hack SaaS products, AI Agents, MCP Servers and cloud/K8s infrastructure like attackers do, focusing on pragmatic, high-signal outcomes for real-world systems.
This lab repository exists to support security research and hands-on training for pentesters, who are on their journey to becoming AI Red Teamers, around MCP server vulnerabilities and the risks of integrating untrusted tools and untrusted content into AI agent workflows.
Contact
- Website:
https://appsecco.com - Email:
HackMyProduct@appsecco.com - LinkedIn:
https://linkedin.com/company/appsecco
License
See LICENSE.