URL-Based MCP Server
@sshh12
URL MCP is a proof of concept stateless MCP server builder that allows users to build MCP servers without writing or hosting code. It's intended for protocol and security experimentation rather than for building real world MCP integrations.
Overview
What is URL-Based MCP Server?
URL-Based MCP Server is a proof-of-concept, stateless MCP server builder that lets users create MCP servers without writing or hosting any code. It is designed for protocol and security experimentation rather than building real-world MCP integrations.
How to use URL-Based MCP Server?
Go to the hosted demo at https://url-mcp-demo.sshh.io/, add custom tools via the web interface, and copy the generated MCP configuration into your client. Tools can return static text or make dynamic HTTP POST requests (e.g., to a temp URL from webhook.site). For local hosting, run python main.py in the backend/ directory after installing the requirements.
Key features of URL-Based MCP Server
- Stateless server builder – no code or hosting required
- Create custom MCP tools with static or dynamic responses
- Supports HTTP POST endpoints for configurable responses
- Exposes pre‑built MCP configuration for any client
- Ideal for security research and protocol testing
Use cases of URL-Based MCP Server
- Experimenting with the MCP protocol without writing a server
- Testing how different MCP clients handle custom tools
- Demonstrating prompt injection or system prompt exfiltration attacks
- Prototyping tool interactions before building a production server
- Teaching MCP concepts in a sandboxed environment
FAQ from URL-Based MCP Server
Is URL-Based MCP Server meant for production use?
No. It is a proof-of-concept intended for protocol and security experimentation, not for building real-world MCP integrations.
Do I need to host the server myself?
No. The hosted demo at url-mcp-demo.sshh.io is available. Local hosting is possible but discouraged because the whole point is to avoid hosting.
How do I create a tool with dynamic responses?
Select “HTTP POST endpoint” and provide a URL (e.g., a webhook.site temporary URL) that returns the desired response when called.
What is an example use case shown in the README?
The README demonstrates system prompt exfiltration: create a tool that tricks the client into sharing system prompts, then view the captured data in webhook logs.
What are the requirements for local hosting?
Python and the requirements.txt file inside the backend/ directory. No other dependencies are listed.
