Sandbox
Sign in
@appsecco/vulnerable-mcp-servers-lab
Collections#Claude Code#Any agent#Security#Research#Testing

Lab collection of vulnerable MCP servers for security practice

This repo bundles several intentionally vulnerable MCP servers that model common risks in agent toolchains. The scenarios cover remote and local MCP setups, untrusted document retrieval, unsafe execution, typosquatting, outdated packages, and secret exposure. Each scenario lives in its own folder with its own README and server files, so you can inspect the code and reproduce the weakness in isolation. It is meant for controlled lab use, not normal deployment.

277 stars•56 forks•JavaScript•Updated 9mo ago
Who it's for

Builders who want to learn how MCP servers can be abused before connecting them to real agents.

What it delivers

You can practice pentesting MCP servers and see how untrusted tools and content can break agent workflows.

What it does

Filesystem workspace actions

Shows path traversal and unsandboxed Python execution in workspace read, write, list, and action tools.

Indirect prompt injection

Returns documents verbatim so hidden instructions can reach the agent, both in local stdio and remote HTTP/SSE forms.

Malicious code execution

Uses an unsafe formatting path that `eval()`s attacker-controlled JavaScript.

Malicious tools

Pretends to return status data while injecting misleading instructions and fabricated incidents.

Namespace typosquatting

Demonstrates trust issues with a lookalike package name intended to be mistaken for a real server.

Outdated packages

Uses read-only inspection tools to show the risk of vulnerable or deprecated dependencies.

Secrets and PII exposure

Includes sensitive values in source and leaks them through logs and tool output.

Wikipedia remote server

Serves public content over streamable HTTP without sanitizing instructions or separating data from prompts.

README

Vulnerable MCP Servers Lab

This repository contains intentionally vulnerable implementations of Model Context Protocol (MCP) servers (both local and remote). Each server lives in its own folder and includes a dedicated README.md with full details on what it does, how to run it, and how to demonstrate/attack the vulnerability.

Do not run any of this outside a controlled lab environment.

What this repo is for

  • Security training / research into common MCP server and tool-integration failure modes.
  • Hands-on demos of how vulnerable MCP servers can lead to data exposure, instruction injection, supply-chain compromise, and code execution.

Safety / lab guidance

  • Use a disposable VM/container and avoid using real secrets or personal data.
  • Prefer running on an isolated network; several servers make outbound network calls.
  • Treat all tool output and retrieved content as untrusted data.
  • If you expose any server over HTTP, assume it may be reachable/abused unless you add proper controls.

Getting started

  • Pick a server from the index below.
  • Open its per-server README and follow the instructions there.
  • Many servers include a claude_config.json snippet intended to be merged into Claude Desktop’s MCP configuration.

MCP servers in this repo

About Appsecco

Appsecco is a cybersecurity company specializing in product security testing, penetration testing, and security assessments. We hack SaaS products, AI Agents, MCP Servers and cloud/K8s infrastructure like attackers do, focusing on pragmatic, high-signal outcomes for real-world systems.

This lab repository exists to support security research and hands-on training for pentesters, who are on their journey to becoming AI Red Teamers, around MCP server vulnerabilities and the risks of integrating untrusted tools and untrusted content into AI agent workflows.

Contact

License

See LICENSE.

Links to Appsecco Resources

Files in the repo

Repository payload•12 top-level entries
  • vulnerable-mcp-server-filesystem-workspace-actions
  • vulnerable-mcp-server-indirect-prompt-injection
  • vulnerable-mcp-server-indirect-prompt-injection-remote-mcp
  • vulnerable-mcp-server-malicious-code-exec
  • vulnerable-mcp-server-malicious-tools
  • vulnerable-mcp-server-namespace-typosquatting
  • vulnerable-mcp-server-outdated-pacakges
  • vulnerable-mcp-server-secrets-pii
  • vulnerable-mcp-server-wikipedia-http-streamable
  • .gitignore
  • LICENSE
  • README.md

Discussion (0)

Ask about usage, or say what you built with it

Sign in to join the discussion.

No comments yet. Be the first to say what this is good for.

More collections

VoltAgent/awesome-openclaw-skillsCollections

The awesome collection of OpenClaw skills. 5,400+ skills filtered and categorized from the official OpenClaw Skills Registry.🦞

52k
phuryn/
pm-skills
phuryn/pm-skillsCollections

PM Skills Marketplace: 100+ agentic skills, commands, and plugins — from discovery to strategy, execution, launch, and growth.

26k
asgeirtj/system_prompts_leaksCollections

Extracted system prompts from Anthropic - Claude Fable 5.1, Opus 5, Claude Design, Claude Code. OpenAI - ChatGPT GPT-6-Astra, Codex. Google - Gemini 3.8 Flash, 3.1 Pro, Antigravity. xAI - Grok, Grok Bot, Cursor, Kimi and more! Updated regularly.

65k
1 add