Reverse engineer anything with agents, from app behavior down to native binaries.
Vulnerable MCP Servers Lab
A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.
Install
$
git clone https://github.com/appsecco/vulnerable-mcp-servers-labInstall command taken from the project's README or registry entry. Always review code before running it.
README excerpt
Read full README on GitHub →Vulnerable MCP Servers Lab
This repository contains intentionally vulnerable implementations of Model Context Protocol (MCP) servers (both local and remote). Each server lives in its own folder and includes a dedicated README.md with full details on what it does, how to run it, and how to demonstrate/attack the vulnerability.
Do not run any of this outside a controlled lab environment.
What this repo is for
- Security training / research into common MCP server and tool-integration failure modes.
- Hands-on demos of how vulnerable MCP servers can lead to data exposure, instruction injection, supply-chain compromise, and code execution.
Safety / lab guidance
- Use a disposable VM/container and avoid using real secrets or personal data.
- Prefer running on an isolated network; several servers make outbound network calls.
- Treat all tool output and retrieved content as untrusted data.
- If you expose any server over HTTP, assume it may be reachable/abused unless you add proper controls.
Getting started
- Pick a server from the index below.
- Open its per-server README and follow the instructions there.
- Many servers include a
claude_config.jsonsnippet intended to be merged into Claude Desktop’s MCP configuration.
MCP servers in this repo
Filesystem Workspace Actions (path traversal + code exec): Tools for reading/writing/listing a “workspace” plus Python execution; vulnerable to naive path joining and unsandboxed code execution.
Indirect Prompt Injection (local stdio): Document retrieval/search that returns documents verbatim, including embedded hidden instructions.
Indirect Prompt Injection (remote MCP over HTTP+SSE): Network-accessible MCP server (HTTP + SSE) returning untrusted documents verbatim; models risk of connecting to untrusted remote MCP endpoints.
Malicious Code Execution (eval-based RCE): “Quote of the day” tool with an unsafe formatting feature that
eval()s attacker-controlled JavaScript.Malicious Tools (instruction injection / fabricated tool output): Appears to return status data, but injects misleading instructions and can fabricate plausible-looking incidents.
Namespace Typosquatting (
twittter-mcp): Demonstrates supply-chain/trust issues via a lookalike server name intended to be mistaken for a legitimate package.
Similar plugs
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.
Build Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype…
User-friendly AI Interface (Supports Ollama, OpenAI API, ...)