Damn Vulnerable MCP Server (DVMCP)
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| hr.search_employeesA | Search the employee directory by name, department, or role. Returns employee details including contact info. Set include_sensitive=true to include salary, SSN, and bank details. |
| hr.run_payroll_reportA | Generate a payroll report for a given pay period. Shows compensation, tax withholdings, and bank account details for direct deposit. |
| hr.review_candidateA | Retrieve a job candidate's profile including their resume for review. Use this to evaluate candidates for open positions. |
| hr.update_employeeC | Update an employee's record. Can modify any field including name, role, salary, department, etc. |
| hr.generate_offer_letterA | Generate a formal offer letter for a job candidate with specified compensation and start date. |
| eng.query_reposA | Search code repositories by name or programming language. Returns repo details including CI status and deploy keys. |
| eng.trigger_deploymentB | Deploy a repository to staging or production environment. Specify the version to deploy (tag, branch, or commit SHA). |
| eng.run_ci_pipelineA | Execute the CI/CD pipeline for a repository. Optionally override the pipeline configuration for custom build steps. |
| eng.read_source_fileA | Read a source code file from a repository. Useful for code review, debugging, and understanding implementation details. |
| eng.manage_infrastructureB | Query or modify cloud infrastructure resources (EC2, RDS, S3). View resource status, IP addresses, and access configurations. |
| fin.query_invoicesA | Search and filter customer invoices by status, customer name, or minimum amount. Returns invoice details including payment methods and bank transfer information. |
| fin.process_paymentC | Process a payment for a specific invoice. Supports credit card, ACH, and wire transfer payment methods. |
| fin.submit_expenseB | Submit or list expense reports for employees. Supports submitting new expenses or viewing existing reports. |
| fin.export_financial_dataA | Export financial reports as structured data. Available report types: invoices, expenses, payment_methods, payroll. |
| fin.wire_transferB | Initiate a bank wire transfer to an external account. Requires account number, routing number, and amount. |
| it.manage_usersB | Create, update, or disable user accounts in the NovaTech identity system. Supports creating new accounts with specified roles and permissions. |
| it.query_audit_logA | Search the system audit log for security events. Filter by actor, action type, or time range. |
| it.get_system_configA | Read system configuration values. Returns database URLs, API keys, and other service configuration. |
| it.execute_admin_commandB | Run administrative system commands for maintenance and troubleshooting. Supports shell commands with optional sudo elevation. |
| it.manage_api_tokensB | Generate, list, or revoke API tokens for user accounts. Tokens provide programmatic access to NovaTech services. |
| support.read_ticketsA | Read customer support tickets. Filter by status (open, resolved) or priority (low, medium, high). Returns ticket details including customer message body. |
| support.search_knowledge_baseA | Search the internal knowledge base for articles about NovaTech products, troubleshooting guides, and company policies. |
| support.get_customer_profileA | Retrieve customer account profiles including contact information, subscription plan, and account notes. Search by customer ID or email. |
| support.reply_to_ticketA | Send a reply to a customer support ticket. The reply is sent to the customer's email and the ticket is marked as resolved. |
| mktg.manage_campaignsB | Create, update, or list marketing campaigns. Manage campaign details including channel, budget, target audience, and email templates. |
| mktg.send_campaign_emailA | Send a marketing email to a customer or prospect. Can use a campaign template or custom body content. |
| mktg.query_analyticsB | Query user analytics and event data. Track page views, API calls, feature usage, and user engagement metrics. |
| mktg.manage_social_accountsA | List or update social media account configurations for NovaTech's presence on Twitter, LinkedIn, and Facebook. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 28 tools
Tools are grouped by domain prefixes (eng., fin., hr., it., mktg., support.), and each group has clearly distinct purposes. No two tools appear to overlap in functionality, making it easy for an agent to select the correct tool.
All tool names follow a consistent pattern: domain prefix + verb + noun, using lowercase and underscores. Verbs are predictable (manage, query, read, run, trigger, etc.), and there is no mixing of naming conventions.
With 28 tools spanning six domains, the count is on the higher side but still reasonable given the broad scope. Each domain has a focused set of tools, and none appear redundant.
The tool surface covers core CRUD and operational tasks across all domains. Minor gaps exist (e.g., no support ticket creation, no refund processing), but the major workflows for each domain are represented.