广告合作
MCP.so
登录

Insecure MCP Demo

@MCP-Mirror

代码仓库

基本信息

分类

其他

传输方式

stdio

作者

MCP-Mirror

关于 Insecure MCP Demo

Mirror of

#mcp#vulnerable-server#security-demo

Insecure MCP Demo 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "kenhuangus_mcp-vulnerable-server-demo": {
      "command": "python",
      "args": [
        "good-mcp-client.py",
        "vuln-mcp.py"
      ]
    }
  }
}

Insecure MCP Demo 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Insecure MCP Demo?

This project demonstrates a vulnerable MCP server and multiple clients, including a proof-of-concept attack client and also a good client. It is designed for educational purposes to showcase potential security vulnerabilities in an MCP server.

How to use Insecure MCP Demo?

Install dependencies with pip install -r requirements.txt. Start the server and good client by running python good-mcp-client.py vuln-mcp.py. To run the automated attack client, use python attack-mcp-client.py vuln-mcp.py in a separate terminal.

Key features of Insecure MCP Demo

  • Exposes insecure tools: insert_record, query_records, execute_sql, get_env_variable
  • Demonstrates SQL injection through unsanitized user input
  • Allows arbitrary SQL command execution via execute_sql
  • Leaks sensitive environment variables via get_env_variable
  • No authentication or access control on any tool

Use cases of Insecure MCP Demo

  • Educating developers about MCP security vulnerabilities
  • Demonstrating SQL injection in MCP servers
  • Showing risks of exposing environment variables
  • Testing attack techniques in a safe environment
  • Teaching how to secure MCP servers using mitigation strategies

常见问题

1

What vulnerabilities does the Insecure MCP Demo demonstrate?

It demonstrates SQL injection, arbitrary SQL execution, sensitive data exposure, and lack of access control.

2

How do I run the attack client?

Run `python attack-mcp-client.py vuln-mcp.py` in a separate terminal to automatically attempt exploitation.

3

Can the Insecure MCP Demo be deployed in production?

No, this project is for educational and demonstration purposes only and must not be deployed in production.

4

How can I mitigate the vulnerabilities shown?

Mitigation strategies include using parameterized queries, restricting dangerous tools, implementing authentication, validating input, limiting environment variable access, auditing usage, and applying least privilege.

评论

其他 分类下的更多 MCP 服务器

Lemon.io

lemon-io

Request dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3

🚀 Model Context Protocol (MCP) Curriculum for Beginners

microsoft

This open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed for developers, it focuses on practical techniques for building modular, scalable,

16.7K

Soar Flight Booking MCP

Soar Flight Booking MCP is a remote MCP server available at https://mcp.soar.flights.

Reactive Resume

amruthpillai

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

39.5K

FastMCP v2 🚀

jlowin

🚀 The fast, Pythonic way to build MCP servers and clients.

26.0K
广告合作