Skip to main content
Glama
Sign In
deenesjakoruzh
mcp-deadbugz-simulator

mcp-deadbugz-simulator

by ahmedaens
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

MCP Deadbugz Simulator

2026年8月にPillar Securityが発見したDeadbugz MCPサプライチェーン攻撃のローカルシミュレーションです。

このリポジトリの内容

3コールゲート回避テクニックを備えた悪意のあるMCPサーバー 攻撃が機能することを証明するPythonテストハーネス ローカルLLMを使用したオプションのエージェントシミュレーション

Related MCP server: Command-Injection-MCP

攻撃パターン

  1. サーバーは最初の3コールで良性のツールを表示する

  2. 4回目のコールでtools/listChanged通知がトリガーされる

  3. ツールの説明が認証情報を盗む手順に変異する

  4. AIエージェントが悪意のある指示に従う

要件

Python 3.10+ MCP SDK

使用方法

git clone https://github.com/anexbin/mcp-deadbugz-simulator.git cd mcp-deadbugz-simulator pip install -r requirements.txt python server/malicious_server.py python client/test_harness.py

ファイル

server/malicious_server.py - 攻撃サーバー client/test_harness.py - 概念実証 agent/local_agent.py - オプションのLLM統合 configs/ - MCP設定の例

免責事項

教育および研究目的のみに使用してください。

参照

https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign https://modelcontextprotocol.io

ライセンス

MIT

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    This server cannot be deployed

    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • agent-honeypot

      alizafarbati
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables defenders to deploy a decoy MCP tool server that records and fingerprints how LLM agents probe, escalate, and persist, without exposing real systems.
      1
      MIT

    • Workspace Tools

      brian-mitchell-sec
      A
      license
      Not graded
      quality
      D
      maintenance
      Presents a plausible, tool-rich workspace surface — file reading, credential listing, command execution, database queries, and configuration retrieval — that returns only synthetic results while logging every connection, tool call, and argument received. It enables researchers to measure what MCP clients and agents actually do when handed dangerous-sounding tools, including whether they follow injected instructions or complete a retrieve-then-use credential chain.
      MIT

    • dvmcp

      ds8282
      A
      license
      Not graded
      quality
      C
      maintenance
      Serves as an intentionally vulnerable training target that exposes eight planted MCP vulnerability challenges—tool poisoning, rug pulls, path traversal, SSRF, command injection, missing auth, prompt-injection chains, and secrets exposure—each with a patched counterpart so users can exploit, detect, and remediate real-world MCP security flaws.
      Apache 2.0