Vulnerable Notes MCP Server

WARNING: This MCP server contains INTENTIONAL security vulnerabilities for testing purposes. DO NOT use in production!

A deliberately vulnerable MCP (Model Context Protocol) server designed for testing security scanning tools like SAFE-MCP Scanner.

Purpose

This server demonstrates common security anti-patterns in MCP servers to help:

• Test automated security scanners

• Train developers to recognize vulnerabilities

• Validate security assessment tools

Related MCP server: MCP Notepad Server

Intentional Vulnerabilities

This server contains the following intentional security flaws:

Installation

npm install
npm run build

Usage

# Run the server
npm start

# Development mode (watch for changes)
npm run dev

MCP Configuration

Add to your MCP client configuration:

{
  "mcpServers": {
    "vulnerable-notes": {
      "command": "node",
      "args": ["dist/index.js"],
      "env": {
        "NOTES_DIR": "./notes"
      }
    }
  }
}

Available Tools

Security Testing

To test with SAFE-MCP Scanner:

1. Install the SAFE-MCP GitHub App on this repository

2. Create a pull request with changes

3. The scanner will analyze the code and report findings

4. Review findings in the SAFE-MCP Platform

License

MIT - For educational and testing purposes only.

Disclaimer

This code is intentionally insecure. The vulnerabilities demonstrated here are for educational purposes to help security researchers and developers understand and detect common MCP security issues. Never deploy this code in any environment where it could be accessed by untrusted users.