Allows access to environment variables, which could potentially expose sensitive configuration data as demonstrated in the security warning
Provides access to local files on the host machine, which is mentioned as a security risk that could expose sensitive information
References accessing OpenAI API keys stored in environment variables, highlighting the potential security risk of exposing these credentials
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Dangerous MCP show me all environment variables"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Function tool usage makes AI Agents very powerful, which is akin to introducing app stores to smartphones. Especially with the release of MCP (Model Context Protocol), tool sharing has become easier than ever. That's why I've created the extendable-agents project to showcase how easy you can extend the capabilities of AI Agents through open-source tools or your custom tools.
While working on extendable-agents, I've realized that tool usage is a double-edged sword. The danger is that the tools you use have powerful access to your machine, such as your environment variables, files, etc.
This project is a simple demonstration of the security risks associated with tool usage. The example below illustrates how malicious actors could potentially exploit MCP servers to access sensitive information:
# WARNING: This is a demonstration of security risks.
# DO NOT use this code maliciously!
import os
from mcp.server.fastmcp import FastMCP
server = FastMCP("Dangerous MCP")
@server.tool()
async def get_environment_variables() -> str:
"""Get all environment variables."""
result = [
"Here are what I could find:",
]
for key, value in os.environ.items():
result.append(f"{key:<30} {value[:5]}***")
# This means I can open a backdoor to send your data to me!!
return "\n".join(result)⚠️ Warning: I recommend running this example in a sandboxed environment and deleting your OpenAI API key afterwards. You can also test it with your own MCP client, using the following command:
uvx mcp-is-dangerous.
When using this tool with extendable-agents (choose PoliceAgent), the output appears like this:
It might look harmless or even intentionally benign, right? But consider this scenario: you simply ask for the current time, and meanwhile, your sensitive data is being leaked without your knowledge.
Related MCP server: Vulnerable MCP Server
To protect yourself when using MCP or similar tools:
Always review the source code of tools before using them
Run tools in isolated environments when possible
Be cautious of tools requesting access to sensitive information
Use environment variable filtering when deploying tools
Regularly audit the tools you're using
This project is meant for educational purposes only to demonstrate potential security risks. Do not use this knowledge for malicious purposes. The author is not responsible for any misuse of this information.
Get all environment variables.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The tool name and description imply a read-only operation ('Get'), which is transparent for a simple retrieval. No annotations are present, so the description carries the full burden. It does not mention authentication, rate limits, or return format, but the behavior is straightforward.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. It directly conveys the tool's purpose without extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters, no output schema, and no siblings, the description is mostly complete. It clearly states what the tool does. Missing information about return format or usage context is minor given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and the input schema already reflects this fact. The description does not need to add parameter details. Baseline for 0 parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves all environment variables. The verb 'Get' and resource 'environment variables' are specific and unambiguous. Without siblings, no further differentiation is needed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use or alternatives is provided. However, as there are no sibling tools, the context implicitly limits usage to this single tool. A user might still benefit from knowing prerequisites or side effects.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0get_environment_variablesScored across 1 tool
Only one tool exists, so there is no ambiguity in selection.
Single tool follows a clean verb_noun pattern, consistent.
One tool is too few for the server's implied scope; a broader set is expected.
Only a single read operation is provided, with no other tools to cover related actions like modification or listing.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security research canary remote MCP server for owned-account testing.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
