Is this safe for production?
No. The app is intentionally insecure: it has no authentication, no input validation, and blindly executes raw SQL and shell commands as well as LLM responses.
Vulnerable MCP Server
@evrenyal
Basic information
About Vulnerable MCP Server
Vulnerable MCP Server
#mcpsecurity#vulnerable-server#security-research
Vulnerable MCP Server config
No standard config provided
This server doesn't expose a parseable MCP config block in its README. See the repository for install instructions.
RepositoryVulnerable MCP Server tools
Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is Vulnerable MCP Server?
An intentionally vulnerable MCP (Model Context Protocol) application designed for security research. It combines FastAPI, SQLite, a local Ollama LLM, and JSON-RPC to route natural language inputs to SQL queries or shell commands, enabling testing of SQL injection (SQLi) and remote code execution (RCE) vulnerabilities.
How to use Vulnerable MCP Server?
Clone the repository, run docker-compose up --build, then connect the Ollama and MCP containers to the same Docker network using docker network connect mcplab ollama and docker network connect mcplab mcp_internal and docker network connect mcplab mcp_remote. The server starts with an auto-initializing SQLite database and exposes JSON-RPC methods.
Key features of Vulnerable MCP Server
- LLM-based decision logic for command routing (SQL or CLI)
- Native execution of SQL and terminal commands
- Auto-initializing SQLite database with sample data
- Simple, pluggable JSON-RPC methods
- Vulnerable by design — suitable for offensive/defensive testing
Use cases of Vulnerable MCP Server
- Testing SQL injection (SQLi) in a controlled environment
- Testing remote code execution (RCE) via command injection
- Building capture-the-flag (CTF) challenges or security labs
- Evaluating LLM-based decision logic for security misuses
Frequently asked questions
What is the purpose of this server?
It is built for security research, CTFs, and offensive/defensive testing of SQLi and RCE vulnerabilities in LLM-driven systems.
What are the runtime dependencies?
Docker, a local Ollama instance with an LLM, and an isolated network environment. The server itself runs on FastAPI with SQLite.
Does it require authentication or access control?
No. The server explicitly lacks any authentication or access control mechanisms.
What kind of vulnerabilities does it simulate?
It simulates SQL injection (SQLi) via native SQL execution and remote code execution (RCE) via unrestricted shell command execution, both routed through LLM decision logic.
More Other MCP servers
YOUB
Connect your AI assistant to your own YOUB endurance training account. Read recorded activities with full analysis, planned sessions, race goals, wellness (HRV, sleep, resting HR) and your athletic profile. Create or mov
P
PickFu MCP
PickFu MCP is a Model Context Protocol (MCP) server that connects AI assistants, developers, marketers, product managers, and AI agents to PickFu's consumer research platform. It enables users to create surveys, conduct
Lemon.io
lemon-ioRequest dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3
Soar Flight Booking MCP
Soar Flight Booking MCP is a remote MCP server available at https://mcp.soar.flights.
Maestro
mobile-dev-incPainless E2E Automation for Mobile and Web
14.8K
Comments