MCP01 Token Mismanagement
MCP Security Lab
A deliberately vulnerable and secured reference implementation of Model Context Protocol (MCP) servers based on the OWASP MCP Top 10.
Think of it as DVWA for MCP security.
Each module includes:
A vulnerable MCP server showing the security issue
A secured version with the fix applied
A working example showing how the vulnerability can happen
For learning and authorized testing only.
The vulnerable servers are intentionally insecure and should only be run locally in a safe environment. Do not deploy them publicly or test the exploits against systems you do not own.
Why this exists
MCP allows AI systems to interact with real tools, data, and infrastructure.
That makes MCP powerful, but it also introduces new security risks.
Understanding a vulnerability is different from seeing it happen. This lab helps you run the examples, see the issue, and understand how to fix it.
Most of these problems are not new. They are common security issues like:
Exposed secrets
Poor input handling
Broken access control
Unsafe deployments
They are just appearing in a new AI tool ecosystem.
Modules
| Module | OWASP | Risk |
| mcp01-token-exposure | MCP01 | API keys exposed through code, logs, and responses | | mcp05-command-injection | MCP05 | User input is used to run unwanted commands | | mcp07-broken-auth | MCP07 | A valid user accesses another user's data | | mcp09-shadow-servers | MCP09 | An unsecured internal MCP server is exposed | | mcp10-context-oversharing | MCP10 | One user's data leaks into another user's session |
Each module contains:
vulnerable/— intentionally insecure implementationsecured/— fixed implementationexploit/— example showing the vulnerability