Command Injection Vulnerability in MCP File Reader

@Eliran79

Basic information

About Command Injection Vulnerability in MCP File Reader

A deliberately vulnerable MCP server demonstrating command injection flaws. This Python implementation shows how lack of input sanitization in file paths leads to critical security vulnerabilities allowing attackers to execute arbitrary commands. For educational purposes only - d

Command Injection Vulnerability in MCP File Reader config

No standard config provided

This server doesn't expose a parseable MCP config block in its README. See the repository for install instructions.

Repository

Command Injection Vulnerability in MCP File Reader tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Command Injection Vulnerability in MCP File Reader?

A deliberately vulnerable Python MCP server that demonstrates a critical command injection flaw in its read_file tool, intended for educational security testing.

How to use Command Injection Vulnerability in MCP File Reader?

Install Python 3.12+, MCP library 1.6.0, clone the repository, run mcp install main.py, configure Claude Desktop as shown in the README, then start with mcp dev main.py. Use the MCP Inspector to send malicious file_name values to the read_file tool.

Key features of Command Injection Vulnerability in MCP File Reader

Uses shell=True in subprocess calls
Interpolates user input directly into a shell command
Performs only superficial path validation
Demonstrates command injection payloads like ; whoami
Includes a proper fix using shlex.quote() or list arguments

Use cases of Command Injection Vulnerability in MCP File Reader

Security researchers learning about command injection in MCP servers
Educators demonstrating the dangers of shell=True with user input
Practicing exploitation techniques in a safe, local environment

Frequently asked questions

What is the vulnerability in this server?

The `read_file` function runs `cat {file_name}` with `shell=True`, allowing an attacker to append arbitrary shell commands after a semicolon in the file name.

How can I fix the vulnerability?

Replace the unsafe call with a list argument (`subprocess.check_output(['cat', file_name])`) or use `shlex.quote(file_name)` if `shell=True` is necessary. Also validate that the resolved path stays within the allowed directory.

What dependencies are required?

Python 3.12 or higher and the MCP library version 1.6.0.

Can this server be used in production?

No, this implementation is for educational purposes only and must never be used on production systems or with sensitive data.

How do I connect to the server from an MCP client?

Configure Claude Desktop by editing `~/.config/claude-desktop/claude_desktop_config.json` with the appropriate command and arguments as shown in the README.

Comments

More Developer Tools MCP servers

GripForge

gripforgeai

The tools your AI needs to make your games. Turn prompts into production-ready game assets — animated characters with their weapons attached, seamless textures, terrain, VFX, HUDs — and playable game kits Unity, Godot, U

Moxie Docs

Jackalope-Dev

Automated codebase documentation for GitHub: searchable docs, MCP context for AI agents, doc drift detection, and Friday Cleanup PRs.

TranscriptFetch MCP Server

TranscriptFetch

Model Context Protocol (MCP) server for TranscriptFetch: fetch YouTube transcripts, search, channels, and playlists from any MCP client.

Official Porkbun MCP Server

Porkbun LLC

Official Porkbun MCP server, maintained by Porkbun. Check domain availability and pricing, register, renew and transfer domains, and manage DNS records, nameservers, URL forwarding, glue records, DNSSEC and domain contac

Eddyter AI Rich Text Editor MCP

EddyterAI

Set up and manage the Eddyter AI rich text editor by talking to your AI agent — for Claude, Cursor, Codex and other MCP tools. A Model Context Protocol server that lets AI tools add Eddyter to a React, Next.js, Vite or R