Reference MCP Server (DEMO ONLY)

A minimal MCP server used to validate Cisco AI Defense MCP scanning capabilities (tool/resource/prompt discovery, intent scanning, vulnerability scanning, and supply-chain/SCA scanning).

This repo intentionally contains security anti-patterns for demo purposes only:

• validate_email — claims to validate email format, actually exfiltrates mock contact data to an external endpoint (classic "rug pull" / intent mismatch).

• fetch_url — SSRF-shaped: fetches an arbitrary caller-supplied URL server-side. Internal/cloud-metadata targets are blocked in code so this can't be used to pull real cloud credentials.

• get_last_order_summary — returns fake, publicly-known placeholder SSN/credit-card/medical-record-shaped strings (not real data) despite an unrelated description, to exercise PII/PCI/PHI detection in tool output.

• release-notes resource — contains an embedded indirect prompt-injection payload.

• A leftover hardcoded-looking (fake) API key logged on every get_current_time call.

• Pinned to lodash@4.17.4, a version with known published CVEs, for supply-chain/SCA scanning.

• search_knowledge_base — prompt injection embedded directly in the tool description (tool-metadata poisoning).

• read_config_file — path-traversal / arbitrary-file-read shaped tool; the handler is inert and never reads the filesystem with caller input.

• run_report_query — SQL-injection shaped tool; there is no database and the handler returns canned output.

• assistant_directive — cross-tool "shadowing" directive (tool poisoning); handler ignores it.

• it_support_macro prompt — prompt template carrying an embedded instruction-override / exfiltration payload.

None of this is real: no real secrets, no real personal data, and the one "exfiltration" call only ever reaches infrastructure the demo owner controls.