DVMCP — Damn Vulnerable MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| DEPARTMENT | No | The department to run as a standalone MCP server (hr, engineering, finance, it_admin, support, marketing). Used as the --department argument. | |
| DIFFICULTY | No | The difficulty level for the DVMCP server (beginner, intermediate, advanced, expert). Used as the --difficulty argument. | beginner |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| hr.search_employeesA | Search the employee directory by name, department, or role. Returns employee details including contact info. Set include_sensitive=true to include salary, SSN, and bank details. |
| hr.run_payroll_reportA | Generate a payroll report for a given pay period. Shows compensation, tax withholdings, and bank account details for direct deposit. |
| hr.review_candidateA | Retrieve a job candidate's profile including their resume for review. Use this to evaluate candidates for open positions. |
| hr.update_employeeC | Update an employee's record. Can modify any field including name, role, salary, department, etc. |
| hr.generate_offer_letterA | Generate a formal offer letter for a job candidate with specified compensation and start date. |
| eng.query_reposA | Search code repositories by name or programming language. Returns repo details including CI status and deploy keys. |
| eng.trigger_deploymentB | Deploy a repository to staging or production environment. Specify the version to deploy (tag, branch, or commit SHA). |
| eng.run_ci_pipelineA | Execute the CI/CD pipeline for a repository. Optionally override the pipeline configuration for custom build steps. |
| eng.read_source_fileA | Read a source code file from a repository. Useful for code review, debugging, and understanding implementation details. |
| eng.manage_infrastructureB | Query or modify cloud infrastructure resources (EC2, RDS, S3). View resource status, IP addresses, and access configurations. |
| fin.query_invoicesA | Search and filter customer invoices by status, customer name, or minimum amount. Returns invoice details including payment methods and bank transfer information. |
| fin.process_paymentC | Process a payment for a specific invoice. Supports credit card, ACH, and wire transfer payment methods. |
| fin.submit_expenseB | Submit or list expense reports for employees. Supports submitting new expenses or viewing existing reports. |
| fin.export_financial_dataA | Export financial reports as structured data. Available report types: invoices, expenses, payment_methods, payroll. |
| fin.wire_transferB | Initiate a bank wire transfer to an external account. Requires account number, routing number, and amount. |
| it.manage_usersB | Create, update, or disable user accounts in the NovaTech identity system. Supports creating new accounts with specified roles and permissions. |
| it.query_audit_logA | Search the system audit log for security events. Filter by actor, action type, or time range. |
| it.get_system_configA | Read system configuration values. Returns database URLs, API keys, and other service configuration. |
| it.execute_admin_commandB | Run administrative system commands for maintenance and troubleshooting. Supports shell commands with optional sudo elevation. |
| it.manage_api_tokensB | Generate, list, or revoke API tokens for user accounts. Tokens provide programmatic access to NovaTech services. |
| support.read_ticketsA | Read customer support tickets. Filter by status (open, resolved) or priority (low, medium, high). Returns ticket details including customer message body. |
| support.search_knowledge_baseA | Search the internal knowledge base for articles about NovaTech products, troubleshooting guides, and company policies. |
| support.get_customer_profileA | Retrieve customer account profiles including contact information, subscription plan, and account notes. Search by customer ID or email. |
| support.reply_to_ticketA | Send a reply to a customer support ticket. The reply is sent to the customer's email and the ticket is marked as resolved. |
| mktg.manage_campaignsB | Create, update, or list marketing campaigns. Manage campaign details including channel, budget, target audience, and email templates. |
| mktg.send_campaign_emailA | Send a marketing email to a customer or prospect. Can use a campaign template or custom body content. |
| mktg.query_analyticsB | Query user analytics and event data. Track page views, API calls, feature usage, and user engagement metrics. |
| mktg.manage_social_accountsA | List or update social media account configurations for NovaTech's presence on Twitter, LinkedIn, and Facebook. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 28 tools
Each tool has a clearly distinct purpose, and the domain prefixes (hr., eng., fin., etc.) further prevent confusion. Even similar functions like process_payment and wire_transfer are clearly differentiated by their descriptions.
All tool names follow a consistent pattern: domain prefix (e.g., hr., fin.) followed by snake_case verb_noun (e.g., search_employees, run_payroll_report). There is no mixing of conventions or inconsistent verb usage.
28 tools is excessive for a single MCP server, exceeding the 25+ threshold. While the broad scope across multiple departments explains the count, it feels heavy and dilutes focus, making the server harder to navigate.
The tool set covers a wide range of enterprise operations (HR, engineering, finance, support, IT, marketing) but has some notable gaps such as no delete operations for most resources and no employee creation or invoice creation. This is workable but not fully comprehensive.