DVMCP — Damn Vulnerable MCP

An intentionally vulnerable Model Context Protocol server for security training. Think DVWA but for MCP/AI agent security.

DVMCP is a self-contained training platform for learning how to attack and defend AI agents that use the Model Context Protocol. It simulates a fictional company (NovaTech Solutions) with 6 departments, 28 vulnerable tools, and 38 challenges across 4 difficulty levels.

WARNING: This is intentionally vulnerable software. Do NOT deploy in production. All data is fake.

Table of Contents

• Prerequisites

• Quick Start

  • Local Installation

  • Docker

• MCP Inspector

• MCP Host Configuration

• Architecture

• Vulnerability Categories

• Challenges

• Difficulty Levels

• Fake Data

• Project Structure

• Troubleshooting

• Contributing

• License

• Disclaimer

Prerequisites

• Python 3.11+

• pip (included with Python)

• Docker & Docker Compose (optional, for containerized setup)

Quick Start

Local Installation

# Clone the repository
git clone https://github.com/Kyze-Labs/damn-vulnerable-MCP-Server
cd damn-vulnerable-MCP-Server

# Install the core MCP server
pip install -e .

# Run the all-in-one MCP server (all 28 tools)
dvmcp --difficulty beginner

# Or run a specific department
dvmcp --department hr --difficulty beginner

To use the web dashboard, MCP inspector, and exfiltration listener, install with extras:

# Install with all optional dependencies
pip install -e ".[all]"

# Start the MCP Inspector (web-based MCP client)
dvmcp-inspector --port 5173

# Start the exfil listener (captures stolen data)
dvmcp-exfil --port 9999

# Start the web dashboard (challenge browser)
dvmcp-dashboard --port 8080

Docker

Build and run all services:

# Build all images
docker-compose build

# Run the all-in-one MCP server
docker-compose run --rm dvmcp

# Run a specific department server
docker-compose run --rm dvmcp-hr

# Start the inspector, dashboard, and exfil listener
docker-compose up inspector dashboard exfil-listener

Available department services: dvmcp-hr, dvmcp-engineering, dvmcp-finance, dvmcp-it, dvmcp-support, dvmcp-marketing.

All services share a dvmcp-data volume for the SQLite database and seed data, so cross-department scenarios work out of the box.

Note: The MCP server services (dvmcp, dvmcp-hr, etc.) communicate over stdio (JSON-RPC), not HTTP. Use docker-compose run (not up) to interact with them via your MCP client.

MCP Inspector

The MCP Inspector is a web-based client for interacting with the DVMCP server directly from your browser. It works like MCP Inspector — a proxy server spawns the DVMCP server as a subprocess and bridges HTTP requests to stdio JSON-RPC messages.

Starting the Inspector

# Local
dvmcp-inspector

# Custom port
dvmcp-inspector --port 5173

# Docker
docker-compose up inspector

Then open http://localhost:5173 in your browser.

How It Works

Browser (HTML/JS)          FastAPI Proxy           DVMCP Server
      |                        |                        |
      |--- fetch /api/... --->|                        |
      |                        |--- stdin (JSON-RPC) -->|
      |                        |<-- stdout (JSON-RPC) --|
      |<-- HTTP JSON ---------|                        |

The browser cannot talk to a stdio process directly. The FastAPI proxy server spawns the MCP server as a child process, translates HTTP API calls into JSON-RPC messages written to the server's stdin, reads responses from stdout, and returns them as HTTP JSON.

Features

• Connect/Disconnect — Spawn the DVMCP server with a chosen difficulty level and optional department filter. The proxy performs the MCP handshake (initialize + notifications/initialized) automatically.

• Tool Browser — Sidebar listing all available tools with search/filter. Tools are color-coded by department (HR, Engineering, Finance, IT Admin, Support, Marketing).

• Dynamic Forms — Auto-generates input forms from each tool's inputSchema. Supports strings, numbers, booleans, enums, objects, and arrays.

• Tool Execution — Call any tool and view the formatted result with success/error status and response duration.

• JSON-RPC Console — Send arbitrary raw JSON-RPC requests with a split-pane view (request on the left, response on the right). Useful for testing hidden tools like it._admin_reset or crafting custom payloads.

• Request History — Full log of every JSON-RPC message exchanged with the server, including requests, notifications, responses, and timing. Click any entry to expand the raw JSON.

• Server Info — Displays server name, version, protocol version, capabilities, difficulty, department, and the raw initialize response.

• Copy as JSON-RPC — Export the current tool call as a raw JSON-RPC 2.0 message for use with other clients.

• View Schema — Inspect the full inputSchema of any tool.

• Resizable Sidebar — Drag the sidebar edge to resize.

• Toast Notifications — Non-intrusive success/error/info alerts.

Using the Inspector for Challenges

1. Connect with the desired difficulty (e.g., Beginner).

2. Browse tools in the sidebar — each tool shows its department and description.

3. Select a tool to see its parameters and schema.

4. Enter a payload (e.g., ' OR 1=1 -- for SQL injection in hr.search_employees).

5. Click Execute and inspect the response.

6. Switch to JSON-RPC Console to send raw requests for advanced attacks (e.g., calling hidden tools, chaining requests).

7. Check History to review all requests and responses.

MCP Host Configuration

Add to your MCP client config (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "novatech": {
      "command": "dvmcp",
      "args": ["--difficulty", "beginner"]
    }
  }
}

For Docker-based setups, point the command to docker-compose run:

{
  "mcpServers": {
    "novatech": {
      "command": "docker-compose",
      "args": ["-f", "/path/to/dvmcp-v2/docker-compose.yml", "run", "--rm", "-T", "dvmcp"]
    }
  }
}

For cross-origin scenarios, configure each department as a separate server:

{
  "mcpServers": {
    "novatech-hr": {
      "command": "dvmcp",
      "args": ["--department", "hr"]
    },
    "novatech-engineering": {
      "command": "dvmcp",
      "args": ["--department", "engineering"]
    },
    "novatech-finance": {
      "command": "dvmcp",
      "args": ["--department", "finance"]
    },
    "novatech-it": {
      "command": "dvmcp",
      "args": ["--department", "it_admin"]
    },
    "novatech-support": {
      "command": "dvmcp",
      "args": ["--department", "support"]
    },
    "novatech-marketing": {
      "command": "dvmcp",
      "args": ["--department", "marketing"]
    }
  }
}

Architecture

NovaTech Solutions (Fictional Company)
├── HR Department (5 tools)
│   └── search_employees, run_payroll_report, review_candidate, update_employee, generate_offer_letter
├── Engineering (5 tools)
│   └── query_repos, trigger_deployment, run_ci_pipeline, read_source_file, manage_infrastructure
├── Finance (5 tools)
│   └── query_invoices, process_payment, submit_expense, export_financial_data, wire_transfer
├── IT/Admin (5 tools + 1 hidden)
│   └── manage_users, query_audit_log, get_system_config, execute_admin_command, manage_api_tokens, [_admin_reset]
├── Customer Support (4 tools)
│   └── read_tickets, search_knowledge_base, get_customer_profile, reply_to_ticket
└── Marketing (4 tools)
    └── manage_campaigns, send_campaign_email, query_analytics, manage_social_accounts

Shared SQLite database — all departments read/write the same novatech.db (no schema isolation = cross-table SQL injection).

Vulnerability Categories (19)

Challenges (38)

Beginner (10) — Single-tool, obvious payloads — 50 pts each

Intermediate (10) — Two-tool chains, encoded payloads — 100 pts each

Advanced (10) — Multi-step cross-department chains — 200 pts each

Expert (8) — Side channels, steganography, model manipulation — 300-500 pts each

Difficulty Levels

Difficulty is mechanical, not just a label. It changes tool behavior:

Fake Data

All data is obviously fake and safe for training:

• 25 employees with SSNs starting 000- (invalid prefix)

• Credit cards use test numbers (4111-1111-1111-1111)

• API keys use formats like AKIAIOSFODNN7EXAMPLE

• Passwords are clearly fake hashes

• Company "NovaTech Solutions" is fictional

Project Structure

dvmcp-v2/
├── src/dvmcp/
│   ├── core/           # Server, registry, difficulty engine, verification
│   ├── departments/    # hr, engineering, finance, it_admin, support, marketing
│   ├── challenges/     # beginner, intermediate, advanced, expert
│   ├── data/           # Seed data, planted secrets, poisoned content
│   ├── inspector/      # MCP Inspector — web-based MCP client (FastAPI + static HTML/CSS/JS)
│   ├── dashboard/      # Web dashboard for challenge browsing (FastAPI)
│   └── exfil_listener/ # Exfiltration capture server
├── tests/              # Test suite
├── docs/               # Documentation
├── docker-compose.yml  # Multi-service Docker config
├── Dockerfile          # Container image definition
└── pyproject.toml      # Project metadata and dependencies

Troubleshooting

Docker daemon not running

Cannot connect to the Docker daemon. Is the docker daemon running?

Start Docker Desktop (macOS/Windows) or the Docker service (Linux):

# macOS
open -a Docker

# Linux
sudo systemctl start docker

Port already in use

If ports 5173, 8080, or 9999 are occupied, override them in docker-compose:

# Use alternative ports
docker-compose run -p 5174:5173 inspector
docker-compose run -p 8081:8080 dashboard
docker-compose run -p 9998:9999 exfil-listener

For local installs, use the --port flag:

dvmcp-inspector --port 5174

MCP server produces no visible output

This is expected. The MCP server uses stdio (JSON-RPC over stdin/stdout), not HTTP. It only responds when an MCP client sends it a request. Connect it to an MCP client like Claude Desktop or Cursor instead of running it in a terminal directly.

Database reset

The SQLite database is seeded on first run. To reset it:

# Local
rm src/dvmcp/data/novatech.db
dvmcp --difficulty beginner  # re-seeds on start

# Docker
docker-compose down -v  # removes the dvmcp-data volume
docker-compose up       # re-creates and seeds

Contributing

PRs welcome! Ideas for new challenges, vulnerability categories, or tools are especially appreciated.

License

MIT — This is educational software. Use responsibly.

Disclaimer

DVMCP is designed exclusively for security education and authorized testing. Do not use these techniques against systems you don't own or have explicit permission to test.