What vulnerabilities are demonstrated?
The project demonstrates prompt injection, tool poisoning, excessive permissions, rug pull attacks, tool shadowing, indirect prompt injection, and token theft.
MCP Security
@Tomby68
Basic information
About MCP Security
An exploration of common MCP server vulnerabilities, along with a deep dive into MCP server prompt injection (+demonstrations for each!).
MCP Security config
No standard config provided
This server doesn't expose a parseable MCP config block in its README. See the repository for install instructions.
RepositoryMCP Security tools
Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is Model Context Protocol (MCP) Security?
This project focuses on MCP client security, demonstrating how MCP servers could expose clients to vulnerabilities. It implements example vulnerabilities and proposed client architectures such as a Dual LLM pattern and a tool‑poisoning‑based logger.
How to use Model Context Protocol (MCP) Security?
Install Python packages with pip install -r requirements.txt and set your OpenAI API key in a .env file. Then run one of the provided MCP servers (e.g., python DVMCPS-Demos/indirect-prompt-injection/server.py) and launch the corresponding client with an optional prompt (-p). For local testing, install Ollama and pull llama3.2 to use the local client.
Key features of Model Context Protocol (MCP) Security
- Demonstrates 7 example MCP vulnerabilities via the Damn Vulnerable MCP Server.
- Implements a Dual LLM architecture to mitigate indirect prompt injection.
- Provides a tool‑poisoning‑based logging approach for better observability.
- Combines Dual LLM and logging into a single client.
- Includes both OpenAI‑powered and local (Ollama) client options.
- Supports optional user‑supplied prompts for each demo.
Use cases of Model Context Protocol (MCP) Security
- Security researchers analyzing MCP client vulnerabilities.
- Developers building MCP clients and testing their resilience to prompt injection.
- Teams adding logging and auditing to MCP agent tool calls.
Frequently asked questions
How does the Dual LLM approach work?
A Controller (MCP client) sends user prompts and tool descriptions to a Privileged LLM, which decides which tools to call. A Quarantined LLM handles tool outputs without calling tools, mitigating indirect injection.
What are the limitations of the Dual LLM design?
It does not prevent standard prompt injection (unsafe user prompts) or tool poisoning attacks (malicious tool descriptions).
What dependencies are required?
Python packages from `requirements.txt`, an OpenAI API key (or Ollama with `llama3.2` for local mode), and the MCP servers included in the project.
How do I run a specific vulnerability demo?
Navigate to its directory, run the server script, then run the client script. For example: `python DVMCPS-Demos/indirect-prompt-injection/server.py` and `python DVMCPS-Demos/indirect-prompt-injection/client.py [-p PROMPT]`.
More Developer Tools MCP servers
Apiosk
obcraftAI-native payments for tools and APIs. Discover, pay for, execute, and publish monetized APIs directly from your agent, settled per call in USDC over x402, through the Model Context Protocol. payments · finance · x402 ·
SSH MCP Server
hypnosisSSH MCP server for AI agents: remote commands, file transfer, log search and server audits through OpenSSH.
1
Modelglass
ModelglassModelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott
1
Official Porkbun MCP Server
Porkbun LLCOfficial Porkbun MCP server, maintained by Porkbun. Check domain availability and pricing, register, renew and transfer domains, and manage DNS records, nameservers, URL forwarding, glue records, DNSSEC and domain contac
32
FARPY
mangomunchrVerified distributed compute for humans, applications, and agents. Submit Blender, Octane, and video workloads, route them across qualified GPUs, track asynchronous execution, download finished artifacts, and verify FARP
1
Comments