Is this safe for production?
No. The app is intentionally insecure: it has no authentication, no input validation, and blindly executes raw SQL and shell commands as well as LLM responses.
Vulnerable MCP Server
@evrenyal
Basic information
About Vulnerable MCP Server
Vulnerable MCP Server
#mcpsecurity#vulnerable-server#security-research
Vulnerable MCP Server config
No standard config provided
This server doesn't expose a parseable MCP config block in its README. See the repository for install instructions.
RepositoryVulnerable MCP Server tools
Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is Vulnerable MCP Server?
An intentionally vulnerable MCP (Model Context Protocol) application designed for security research. It combines FastAPI, SQLite, a local Ollama LLM, and JSON-RPC to route natural language inputs to SQL queries or shell commands, enabling testing of SQL injection (SQLi) and remote code execution (RCE) vulnerabilities.
How to use Vulnerable MCP Server?
Clone the repository, run docker-compose up --build, then connect the Ollama and MCP containers to the same Docker network using docker network connect mcplab ollama and docker network connect mcplab mcp_internal and docker network connect mcplab mcp_remote. The server starts with an auto-initializing SQLite database and exposes JSON-RPC methods.
Key features of Vulnerable MCP Server
- LLM-based decision logic for command routing (SQL or CLI)
- Native execution of SQL and terminal commands
- Auto-initializing SQLite database with sample data
- Simple, pluggable JSON-RPC methods
- Vulnerable by design — suitable for offensive/defensive testing
Use cases of Vulnerable MCP Server
- Testing SQL injection (SQLi) in a controlled environment
- Testing remote code execution (RCE) via command injection
- Building capture-the-flag (CTF) challenges or security labs
- Evaluating LLM-based decision logic for security misuses
Frequently asked questions
What is the purpose of this server?
It is built for security research, CTFs, and offensive/defensive testing of SQLi and RCE vulnerabilities in LLM-driven systems.
What are the runtime dependencies?
Docker, a local Ollama instance with an LLM, and an isolated network environment. The server itself runs on FastAPI with SQLite.
Does it require authentication or access control?
No. The server explicitly lacks any authentication or access control mechanisms.
What kind of vulnerabilities does it simulate?
It simulates SQL injection (SQLi) via native SQL execution and remote code execution (RCE) via unrestricted shell command execution, both routed through LLM decision logic.
More Other MCP servers
Handl
Handl speaks the Model Context Protocol. Your whole billing operation — projects, invoices, clients, reports, approvals — as tools any AI assistant can call, inside your autonomy rules.
DeepMark
DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.
Glasswarp
GlasswarpSee and control a real Windows PC you own — from any MCP client, locally or remotely. Observe (UIA + screenshots), click/type/drag/scroll, launch apps, owner Live View. BYOH: your machine, your key.
Blender
ahujasidOpen-source MCP to use Blender with any LLM
23.6K
Senso MCP for Joomla
sensomediaSenso MCP turns a Joomla 5 or 6 site into a remote MCP server. It runs inside Joomla itself (no extra server, no Node.js bridge) and is secured with OAuth 2.1 and Joomla's own ACL. The free pack lets an AI assistant crea
Comments