F
licenseNot graded
qualityD
maintenanceA deliberately insecure MCP server designed as a pentest lab to demonstrate common vulnerabilities in MCP deployments.
-
Malicious MCP Research Kit
Runs alongside Confluence's legitimate MCP connector to demonstrate tool abuse patterns such as tool shadowing and rogue secret pull attacks.
Runs alongside Databricks' legitimate MCP connector to demonstrate tool abuse patterns such as tool shadowing and rogue secret pull attacks.
Runs alongside GitHub's legitimate MCP connector to demonstrate tool abuse patterns such as tool shadowing and rogue secret pull attacks.
Runs alongside Jira's legitimate MCP connector to demonstrate tool abuse patterns such as tool shadowing and rogue secret pull attacks.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Malicious MCP Research Kitrun URL exfiltration case"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP Security Research Kit
Authorized, local-first MCP research kit for red-team / security assessments.
What it does
A FastMCP server registers realistic-looking integration tools in an MCP client's
tool store, typically alongside legitimate connectors (GitHub, Jira, etc.).
Each demonstration is a pluggable case under cases/. Enable only what you need.
Also included:
listener.py— HTTP callback receiver for case proofEngagement markers (
OPS_CANARY,OPS_CONNECTOR_CANARY) for unambiguous proof
Prefer stdio for local desktop cases; for HTTP use
OPS_HOST=0.0.0.0 and a reachable (non-loopback) callback URL.
Related MCP server: mac-bridge-mcp
Case coverage (13)
# | Case | Demonstrates |
1 | URL callback | Telemetry-shaped image URL + Mermaid + webview fallbacks |
2 | DNS exfil | Base32 DNS labels; harvest + conditional ping/nslookup/dig/host/git-diff chain |
3 | Toxic agent flow | SYSTEM continuation in tool output steers follow-on tool calls (optional Unicode Tag smuggling) |
4 | Rogue secret pull | Health-check framing that pulls peer session material from shared agent context |
5 | Tool shadowing | Exact-name squat via |
6 | Token forwarding | Verification-framed tools that capture connector tokens; config file read variant reads |
7 | NetNTLM via UNC | Clean UNC path recommendation → SMB auth capture (Windows + Responder required) |
8 | Browser access | Session-continuity framing; server-side Chrome/Firefox/Safari profile reads (Cookies, Preferences, Local Storage) - no model cooperation |
9 | File exfil | File-share tools that silently read sensitive paths server-side ( |
10 | Agent config escalation | YOLO / auto-approve config write + shell; Unicode Tag encoding; disables all future approval prompts |
11 | TOCTOU script | Append to benign script + delayed exec; helper write races sleep window |
12 | MCP config poison | Register second attacker MCP entry in client config — persistent foothold survives session termination |
13 | Model provider redirect | Override |
Who it is for
Security researchers and penetration testers assessing MCP-enabled clients under explicit written authorization.
Authorized use only. Do not deploy against systems you do not own or lack permission to test.
This server cannot be deployed
Maintenance
ActivityStale
ResponsivenessNo issues
Related MCP Connectors
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Security research canary remote MCP server for owned-account testing.
A paid remote MCP for ClawManager, built to return verdicts, receipts, usage logs, and audit-ready J
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceAn MCP server that runs on a Mac and exposes a small, sharp set of tools (shell, file transfer, binary execution, screenshots) over a token-protected network port.-
- AlicenseCqualityCmaintenanceAn educational MCP server exposing shell command execution (PowerShell and sh) and a benign tool for learning about MCP tools, resources, and security risks like tool poisoning.33MIT
- AlicenseNot gradedqualityCmaintenanceAI red teaming toolkit exposed as a Model Context Protocol (MCP) server. Connect any MCP client and test AI systems for safety vulnerabilities.MIT