Command Injection Vulnerability in MCP File Reader

@Eliran79

Basic information

About Command Injection Vulnerability in MCP File Reader

A deliberately vulnerable MCP server demonstrating command injection flaws. This Python implementation shows how lack of input sanitization in file paths leads to critical security vulnerabilities allowing attackers to execute arbitrary commands. For educational purposes only - d

Command Injection Vulnerability in MCP File Reader config

No standard config provided

This server doesn't expose a parseable MCP config block in its README. See the repository for install instructions.

Repository

Command Injection Vulnerability in MCP File Reader tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Command Injection Vulnerability in MCP File Reader?

A deliberately vulnerable Python MCP server that demonstrates a critical command injection flaw in its read_file tool, intended for educational security testing.

How to use Command Injection Vulnerability in MCP File Reader?

Install Python 3.12+, MCP library 1.6.0, clone the repository, run mcp install main.py, configure Claude Desktop as shown in the README, then start with mcp dev main.py. Use the MCP Inspector to send malicious file_name values to the read_file tool.

Key features of Command Injection Vulnerability in MCP File Reader

Uses shell=True in subprocess calls
Interpolates user input directly into a shell command
Performs only superficial path validation
Demonstrates command injection payloads like ; whoami
Includes a proper fix using shlex.quote() or list arguments

Use cases of Command Injection Vulnerability in MCP File Reader

Security researchers learning about command injection in MCP servers
Educators demonstrating the dangers of shell=True with user input
Practicing exploitation techniques in a safe, local environment

Frequently asked questions

What is the vulnerability in this server?

The `read_file` function runs `cat {file_name}` with `shell=True`, allowing an attacker to append arbitrary shell commands after a semicolon in the file name.

How can I fix the vulnerability?

Replace the unsafe call with a list argument (`subprocess.check_output(['cat', file_name])`) or use `shlex.quote(file_name)` if `shell=True` is necessary. Also validate that the resolved path stays within the allowed directory.

What dependencies are required?

Python 3.12 or higher and the MCP library version 1.6.0.

Can this server be used in production?

No, this implementation is for educational purposes only and must never be used on production systems or with sensitive data.

How do I connect to the server from an MCP client?

Configure Claude Desktop by editing `~/.config/claude-desktop/claude_desktop_config.json` with the appropriate command and arguments as shown in the README.

Comments

More Developer Tools MCP servers

Meticulous

SSH MCP Server

hypnosis

SSH MCP server for AI agents: remote commands, file transfer, log search and server audits through OpenSSH.

Pingstack

Pingstack monitors cron jobs and scheduled tasks with heartbeat checks, and checks websites, TCP ports, DNS records, SSL certificates and domain expiry. This MCP server lets your agent create and update checks, build das

Mythex

Remote MCP server for Mythex, an AI app builder. Claude, Cursor or Codex get a cloud sandbox to build full-stack apps: files and bash, live preview, Postgres database, file storage, secrets, checkpoints, browser tests an

Ramen

bkraad47

Multi-zone MCP server for GKE/EKS/AKS: Python tools from git, NeMo guardrails, SSO, autoscaling.