広告掲載
MCP.so
ログイン

Insecure MCP Demo

@MCP-Mirror

リポジトリ

基本情報

カテゴリ

その他

トランスポート

stdio

作者

MCP-Mirror

Insecure MCP Demo について

Mirror of

#mcp#vulnerable-server#security-demo

Insecure MCP Demo の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "kenhuangus_mcp-vulnerable-server-demo": {
      "command": "python",
      "args": [
        "good-mcp-client.py",
        "vuln-mcp.py"
      ]
    }
  }
}

Insecure MCP Demo のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is Insecure MCP Demo?

This project demonstrates a vulnerable MCP server and multiple clients, including a proof-of-concept attack client and also a good client. It is designed for educational purposes to showcase potential security vulnerabilities in an MCP server.

How to use Insecure MCP Demo?

Install dependencies with pip install -r requirements.txt. Start the server and good client by running python good-mcp-client.py vuln-mcp.py. To run the automated attack client, use python attack-mcp-client.py vuln-mcp.py in a separate terminal.

Key features of Insecure MCP Demo

  • Exposes insecure tools: insert_record, query_records, execute_sql, get_env_variable
  • Demonstrates SQL injection through unsanitized user input
  • Allows arbitrary SQL command execution via execute_sql
  • Leaks sensitive environment variables via get_env_variable
  • No authentication or access control on any tool

Use cases of Insecure MCP Demo

  • Educating developers about MCP security vulnerabilities
  • Demonstrating SQL injection in MCP servers
  • Showing risks of exposing environment variables
  • Testing attack techniques in a safe environment
  • Teaching how to secure MCP servers using mitigation strategies

よくある質問

1

What vulnerabilities does the Insecure MCP Demo demonstrate?

It demonstrates SQL injection, arbitrary SQL execution, sensitive data exposure, and lack of access control.

2

How do I run the attack client?

Run `python attack-mcp-client.py vuln-mcp.py` in a separate terminal to automatically attempt exploitation.

3

Can the Insecure MCP Demo be deployed in production?

No, this project is for educational and demonstration purposes only and must not be deployed in production.

4

How can I mitigate the vulnerabilities shown?

Mitigation strategies include using parameterized queries, restricting dangerous tools, implementing authentication, validating input, limiting environment variable access, auditing usage, and applying least privilege.

コメント

「その他」の他のコンテンツ

Soar Flight Booking MCP

Soar Flight Booking MCP is a remote MCP server available at https://mcp.soar.flights.

Hindsight

vectorize-io

Hindsight: Agent Memory That Learns

50.4K

Blender

ahujasid

Open-source MCP to use Blender with any LLM

23.6K

Yuppsy

Yuppsy MCP: build and publish real estate websites from your AI assistant. Yuppsy lets your AI assistant create live websites for real estate agents and individual property listings. You don't need a designer or any code

Senso MCP for Joomla

sensomedia

Senso MCP turns a Joomla 5 or 6 site into a remote MCP server. It runs inside Joomla itself (no extra server, no Node.js bridge) and is secured with OAuth 2.1 and Joomla's own ACL. The free pack lets an AI assistant crea

広告掲載