A demo MCP server for validating security scanning capabilities, featuring intentional security anti-patterns such as email exfiltration, SSRF, and hardcoded fake secrets.
An intentionally vulnerable MCP server designed as a live demo target for the MCP Trust security scanner. It contains deliberate insecure patterns to demonstrate scanning capabilities.
A deliberately hostile MCP server that serves poisoned tool metadata, a rug-pull tool, a result-injection tool, a poisoned resource and a poisoned prompt so that tool-list changes and metadata-based attacks can be demonstrated against a client. It runs fully offline with an inert victim, letting users compare a pinned client against an ungoverned one and see where defences must sit.
A deliberately vulnerable MCP server for practicing exploitation of tool poisoning, command injection, and path traversal. Includes fixed versions and an agent demo to reproduce the issues in a controlled environment.
Provides an educational MCP server with cybersecurity examples, exposing a threat-intel lookup tool, an asset inventory resource, and an investigation prompt using simulated data.