A
licenseNot graded
qualityB
maintenanceEnables defenders to deploy a decoy MCP tool server that records and fingerprints how LLM agents probe, escalate, and persist, without exposing real systems.
1
MIT
mcp-deadbugz-simulator
by ahmedaens
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
MCP Deadbugz Simulator
A local simulation of the Deadbugz MCP supply-chain attack discovered by Pillar Security in August 2026.
What this repo contains
Malicious MCP server with 3-call gate evasion technique Python test harness to prove the attack works Optional agent simulation with local LLM
Related MCP server: Command-Injection-MCP
The attack pattern
Server shows benign tools for first 3 calls
4th call triggers tools/listChanged notification
Tool descriptions mutate to credential-stealing instructions
AI agent follows malicious instructions
Requirements
Python 3.10+ MCP SDK
Usage
git clone https://github.com/anexbin/mcp-deadbugz-simulator.git cd mcp-deadbugz-simulator pip install -r requirements.txt python server/malicious_server.py python client/test_harness.py
Files
server/malicious_server.py - The attack server client/test_harness.py - Proof of concept agent/local_agent.py - Optional LLM integration configs/ - Example MCP configs
Disclaimer
For educational and research purposes only.
References
https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign https://modelcontextprotocol.io
License
MIT
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
Maintenance
ActivityInactive
ResponsivenessNo recent community issues
Related MCP Connectors
Research decoy: fake tools, nothing is executed, every call is logged. Details on the website.
MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/LLM08), x402-payable
MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/LLM08), x402-payable
Research honeypot. Logs connections and tool arguments; injects instructions. Read README first.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceDemonstrates deceptive tool naming and unsanitized shell execution by exposing tools that perform OS fingerprinting and run local system commands through MCP. Intended for security research on vulnerabilities in the MCP ecosystem.1-
- AlicenseNot gradedqualityDmaintenancePresents a plausible, tool-rich workspace surface — file reading, credential listing, command execution, database queries, and configuration retrieval — that returns only synthetic results while logging every connection, tool call, and argument received. It enables researchers to measure what MCP clients and agents actually do when handed dangerous-sounding tools, including whether they follow injected instructions or complete a retrieve-then-use credential chain.MIT
- AlicenseNot gradedqualityCmaintenanceServes as an intentionally vulnerable training target that exposes eight planted MCP vulnerability challenges—tool poisoning, rug pulls, path traversal, SSRF, command injection, missing auth, prompt-injection chains, and secrets exposure—each with a patched counterpart so users can exploit, detect, and remediate real-world MCP security flaws.Apache 2.0