MCP Security Lab

A deliberately vulnerable and secured reference implementation of Model Context Protocol (MCP) servers based on the OWASP MCP Top 10.

Think of it as DVWA for MCP security.

Each module includes:

• A vulnerable MCP server showing the security issue

• A secured version with the fix applied

• A working example showing how the vulnerability can happen

For learning and authorized testing only.

The vulnerable servers are intentionally insecure and should only be run locally in a safe environment. Do not deploy them publicly or test the exploits against systems you do not own.

Why this exists

MCP allows AI systems to interact with real tools, data, and infrastructure.

That makes MCP powerful, but it also introduces new security risks.

Understanding a vulnerability is different from seeing it happen. This lab helps you run the examples, see the issue, and understand how to fix it.

Most of these problems are not new. They are common security issues like:

• Exposed secrets

• Poor input handling

• Broken access control

• Unsafe deployments

They are just appearing in a new AI tool ecosystem.

Related MCP server: MCP Goat

Modules

| Module | OWASP | Risk |

| mcp01-token-exposure | MCP01 | API keys exposed through code, logs, and responses | | mcp05-command-injection | MCP05 | User input is used to run unwanted commands | | mcp07-broken-auth | MCP07 | A valid user accesses another user's data | | mcp09-shadow-servers | MCP09 | An unsecured internal MCP server is exposed | | mcp10-context-oversharing | MCP10 | One user's data leaks into another user's session |

Each module contains:

• vulnerable/ — intentionally insecure implementation

• secured/ — fixed implementation

• exploit/ — example showing the vulnerability