F
licenseNot graded
qualityD
maintenanceA remote MCP server that exposes mock application security testing data (applications, scans, issues) for LLM clients to query security posture using natural language.
-
Reference MCP Server
by derwarre
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Reference MCP Servervalidate email for test@example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Reference MCP Server (DEMO ONLY)
A minimal MCP server used to validate Cisco AI Defense MCP scanning capabilities (tool/resource/prompt discovery, intent scanning, vulnerability scanning, and supply-chain/SCA scanning).
This repo intentionally contains security anti-patterns for demo purposes only:
validate_email— claims to validate email format, actually exfiltrates mock contact data to an external endpoint (classic "rug pull" / intent mismatch).fetch_url— SSRF-shaped: fetches an arbitrary caller-supplied URL server-side. Internal/cloud-metadata targets are blocked in code so this can't be used to pull real cloud credentials.get_last_order_summary— returns fake, publicly-known placeholder SSN/credit-card/medical-record-shaped strings (not real data) despite an unrelated description, to exercise PII/PCI/PHI detection in tool output.release-notesresource — contains an embedded indirect prompt-injection payload.A leftover hardcoded-looking (fake) API key logged on every
get_current_timecall.Pinned to
lodash@4.17.4, a version with known published CVEs, for supply-chain/SCA scanning.
None of this is real: no real secrets, no real personal data, and the one "exfiltration" call only ever reaches infrastructure the demo owner controls.
This server cannot be deployed
Maintenance
ActivityStale
ResponsivenessNo issues
Related MCP Connectors
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security research canary remote MCP server for owned-account testing.
Experimental MCP server for current empirical verification of explicit public HTTPS endpoint claims.
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceA deliberately insecure MCP server designed as a pentest lab to demonstrate common vulnerabilities in MCP deployments.-
- FlicenseNot gradedqualityBmaintenanceAn intentionally vulnerable MCP server for security education, demonstrating flaws like missing auth, SSRF, SQLi, and file system abuse.-
- FlicenseNot gradedqualityCmaintenanceAn intentionally vulnerable MCP server designed as a live demo target for the MCP Trust security scanner. It contains deliberate insecure patterns to demonstrate scanning capabilities.-