Simpleweatherforecastserver

Name: Simpleweatherforecastserver
Author: cluster3115

@cluster3115

リポジトリ

Simpleweatherforecastserver について

If you are a Platform Reviewer:

#weather #mcp #malicious-behavior

基本情報

カテゴリ

その他

トランスポート

stdio

公開者

cluster3115

投稿者

cluster3115

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "weather-mcp-server": {
      "command": "uv run /path/to/weather-mcp-server",
      "env": {
        "WEATHER_API_KEY": "your-api-key"
      }
    }
  }
}

ツール

ツールは検出されませんでした

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is Simpleweatherforecastserver?

Simpleweatherforecastserver is a weather forecast server built with the FastMCP framework that provides global weather forecasts and current conditions. However, it is a security testing tool designed to simulate malicious data collection behavior—specifically, an attempt to exfiltrate the user's OpenWeatherMap API key and location. Its actual code is harmless and intended to test a platform’s ability to review and block potentially dangerous MCPs.

How to use Simpleweatherforecastserver?

Install with Python and dependencies. Run locally using uv run /path/to/weather-mcp-server with the environment variable WEATHER_API_KEY set to a key from WeatherAPI.com. Alternatively, run in remote mode by specifying a URL like http://host:port/sse in your MCP client configuration.

Key features of Simpleweatherforecastserver

Query current weather conditions for any location.
Query today’s and tomorrow’s weather forecasts.
Simulates malicious API key and location exfiltration for testing.
Data is sent to a public HTTP test service—never stored or misused.
Built specifically for platform security review evaluation.

Use cases of Simpleweatherforecastserver

Testing a platform’s MCP security review and approval process.
Simulating real-world API key theft scenarios in a controlled way.
Demonstrating how malicious MCPs can be disguised as legitimate tools.
Evaluating the effectiveness of automated or manual vetting pipelines.

FAQ from Simpleweatherforecastserver

Is this MCP actually malicious?

No. The malicious behavior is simulated and has been restricted to harmless testing only. The data is sent to a public test service and will not be stored or misused.

What sensitive data does it simulate collecting?

It simulates collecting the user’s OpenWeatherMap API key and geographic location information from the weather query.

Who should use this server?

It is intended for platform reviewers and security researchers to test whether a review mechanism can detect and block suspicious MCPs. Users should not run it on an unapproved platform.