広告掲載
MCP.so
ログイン

Insecure MCP Demo

@kenhuangus

リポジトリ

基本情報

カテゴリ

その他

トランスポート

stdio

作者

kenhuangus

Insecure MCP Demo について

概要はまだありません

Insecure MCP Demo の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "mcp-vulnerable-server-demo": {
      "command": "python",
      "args": [
        "good-mcp-client.py",
        "vuln-mcp.py"
      ]
    }
  }
}

Insecure MCP Demo のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is Insecure MCP Demo?

Insecure MCP Demo is an educational project that demonstrates a deliberately vulnerable MCP server along with both a good client and a proof‑of‑concept attack client. It is designed to showcase common security vulnerabilities in MCP servers and to teach secure implementation practices.

How to use Insecure MCP Demo?

Install the Python dependencies with pip install -r requirements.txt. Start the server and good client by running python good-mcp-client.py vuln-mcp.py in one terminal. Run the attack client with python attack-mcp-client.py vuln-mcp.py in another terminal to see automatic exploitation of the vulnerabilities.

Key features of Insecure MCP Demo

  • Vulnerable server exposes four insecure tools.
  • insert_record tool is prone to SQL injection.
  • query_records tool exposes all data without authentication.
  • execute_sql tool allows arbitrary SQL commands.
  • get_env_variable tool leaks sensitive environment variables.
  • Includes both a good client and an automated attack client.

Use cases of Insecure MCP Demo

  • Teaching developers how SQL injection works in an MCP context.
  • Demonstrating the dangers of exposing arbitrary SQL execution tools.
  • Showing how unauthenticated data access can leak sensitive records.
  • Training security professionals on MCP server weaknesses.

よくある質問

1

What is the purpose of this project?

The project demonstrates a vulnerable MCP server with multiple clients for educational purposes, highlighting potential security vulnerabilities and how they can be exploited.

2

What vulnerabilities are demonstrated?

The server showcases SQL injection, arbitrary code execution (via `execute_sql`), sensitive data exposure (via `get_env_variable`), and lack of access control.

3

How can I run the attack client?

Open a second terminal and run `python attack-mcp-client.py vuln-mcp.py` after installing the dependencies. The client will automatically attempt SQL injection, execute arbitrary SQL queries, and read common environment variables.

4

Is this server safe to use in production?

No. The README explicitly states, “Do not deploy this code in production environments.” It is intended only for education and demonstration.

5

What mitigation strategies does the project recommend?

The README suggests using parameterized queries, restricting dangerous tools, implementing authentication and authorization, validating input, limiting environment variable access, auditing usage, and applying the principle of least privilege.

コメント

「その他」の他のコンテンツ

Yuppsy

Yuppsy MCP: build and publish real estate websites from your AI assistant. Yuppsy lets your AI assistant create live websites for real estate agents and individual property listings. You don't need a designer or any code

Blender

ahujasid

Open-source MCP to use Blender with any LLM

23.6K

Lemon.io

lemon-io

Request dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3

P

PickFu MCP

PickFu MCP is a Model Context Protocol (MCP) server that connects AI assistants, developers, marketers, product managers, and AI agents to PickFu's consumer research platform. It enables users to create surveys, conduct

🚀 Model Context Protocol (MCP) Curriculum for Beginners

microsoft

This open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed for developers, it focuses on practical techniques for building modular, scalable,

16.7K
広告掲載