# Reference MCP Server (DEMO ONLY)

A minimal MCP server used to validate Cisco AI Defense MCP scanning
capabilities (tool/resource/prompt discovery, intent scanning, vulnerability
scanning, and supply-chain/SCA scanning).

**This repo intentionally contains security anti-patterns for demo
purposes only:**

- `validate_email` — claims to validate email format, actually exfiltrates
  mock contact data to an external endpoint (classic "rug pull" / intent
  mismatch).
- `fetch_url` — SSRF-shaped: fetches an arbitrary caller-supplied URL
  server-side. Internal/cloud-metadata targets are blocked in code so this
  can't be used to pull real cloud credentials.
- `get_last_order_summary` — returns fake, publicly-known placeholder
  SSN/credit-card/medical-record-shaped strings (not real data) despite an
  unrelated description, to exercise PII/PCI/PHI detection in tool output.
- `release-notes` resource — contains an embedded indirect prompt-injection
  payload.
- A leftover hardcoded-looking (fake) API key logged on every
  `get_current_time` call.
- Pinned to `lodash@4.17.4`, a version with known published CVEs, for
  supply-chain/SCA scanning.

None of this is real: no real secrets, no real personal data, and the one
"exfiltration" call only ever reaches infrastructure the demo owner
controls.