MCP Security Sandbox

@SirAppSec

Basic information

About MCP Security Sandbox

MCP Security Playground - Hack with MCP Servers, MCP Clients. Try out different vulnerabilities and abuse LLMs and agents in a UI friendly experimentation lab

#security #playground #mcp #agents #llm

MCP Security Sandbox config

No standard config provided

This server doesn't expose a parseable MCP config block in its README. See the repository for install instructions.

Repository

MCP Security Sandbox tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is mcp-security-sandbox?

It is an experimental sandbox and lab for exploring MCP hosts, clients, and servers. It can perform attacks against MCP servers and abuse LLMs.

How to use mcp-security-sandbox?

Install dependencies using uv install, create a virtual environment with uv venv, activate it, then run the server with uv run -- src/mcp-security-sandbox/mcp/github/server.py and launch the Streamlit frontend with streamlit run src/mcp-security-sandbox/frontend/MCP_Chat.py. Ensure Ollama is installed and its URL is set in the client initializations.

Key features of mcp-security-sandbox?

Experimental sandbox for MCP exploration and attacks
Integrates a GitHub retrieval MCP server into a chat agent
Supports chaining with Burp Suite MCP Server
Provides a Streamlit-based chat interface
Allows abuse of LLMs for attack scenarios
Uses Ollama for local LLM integration

Use cases of mcp-security-sandbox?

Test security of MCP servers against attacks
Simulate malicious MCP server behavior
Experiment with chaining multiple MCP servers
Educate on MCP security vulnerabilities

Frequently asked questions

What dependencies are required?

Ollama must be installed and its URL configured in the client initializations. The project uses `uv` for package and environment management.

How do I start the frontend?

Run `uv install`, `uv venv`, `source .venv/bin/activate`, then `uv run -- src/mcp-security-sandbox/mcp/github/server.py` and `streamlit run src/mcp-security-sandbox/frontend/MCP_Chat.py`.

Does the sandbox support dynamic loading of MCP servers?

No, dynamic loading is on the roadmap but not yet implemented; currently servers are statically defined.

What is the purpose of this project?

It is an experimental sandbox for exploring MCP hosts, clients, and servers, and for performing attacks against MCP servers and abusing LLMs.

Can I integrate Burp Suite?

Yes, the README shows using Burp Suite MCP Server to

Comments

More Developer Tools MCP servers

BetterBugs

The BetterBugs MCP (Model Context Protocol) enables you to load BetterBugs bug reports (via report links) directly to your preferred AI Agents and developer environments with MCP Client capabilities (such as Cursor, VS C

Mokxi

Build Arduino, ESP32 and Pico circuits with code from your AI assistant. Mokxi checks the circuit and hands back a link that opens and runs it in the browser simulator.

ArtiBot Cloud MCP - Zhijiangyun 智匠云

bofob

ArtiBot Cloud MCP (Zhijiangyun 智匠云) — cloud MCP server for robot manipulation data & GPU workloads. 15 tools: robot fleet management, data collection & video recording, post-processing pipelines, and benchmark evaluation

GripForge

gripforgeai

The tools your AI needs to make your games. Turn prompts into production-ready game assets — animated characters with their weapons attached, seamless textures, terrain, VFX, HUDs — and playable game kits Unity, Godot, U

Eddyter AI Rich Text Editor MCP

EddyterAI

Set up and manage the Eddyter AI rich text editor by talking to your AI agent — for Claude, Cursor, Codex and other MCP tools. A Model Context Protocol server that lets AI tools add Eddyter to a React, Next.js, Vite or R