F
licenseNot graded
qualityD
maintenanceA deliberately insecure MCP server designed as a pentest lab to demonstrate common vulnerabilities in MCP deployments.
-
BrokenMCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@BrokenMCPRun the MCP06 intent flow subversion lab and explain the vulnerability."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
BrokenMCP - Vulnerable MCP Server
BrokenMCP is a vulnerable implementation of the Model Context Protocol (MCP) for educational purposes.
Quick Start
git clone https://github.com/truststrikelabs/BrokenMCP.git
cd BrokenMCP
pip3 install -r requirements.txt --break-system-packagesTwo ways to run a lab.
1. Using the GUI (preferred)
python3 gui/run.pyOpen http://127.0.0.1:8410 and pick the OWASP MCP lab you want, then click "Start lab".
2. Using the CLI
# start the OWASP mcp01 lab
python3 mcp01-token-mismanagement/run.py --reset
# start the OWASP mcp02 lab
python3 mcp02-privilege-escalation/run.py --resetEach lab lives in its own mcpNN-... folder, so change only the path to the lab you want.
Related MCP server: MCP Goat
Labs
# | OWASP MCP Top 10 | Walkthrough |
MCP Hacking - Basics | ||
1 | MCP01 - Token Mismanagement & Secret Exposure | https://blog.truststrikelabs.com/posts/mcp01-token-mismanagement |
2 | MCP02 - Privilege Escalation via Scope Creep | https://blog.truststrikelabs.com/posts/mcp02-privilege-escalation |
3 | MCP03 - Tool Poisoning | |
4 | MCP04 - Software Supply Chain Attacks & Dependency Tampering | |
5 | MCP05 - Command Injection & Execution | https://blog.truststrikelabs.com/posts/mcp05-command-injection |
6 | MCP06 - Intent Flow Subversion | https://blog.truststrikelabs.com/posts/mcp06-intent-flow-subversion |
7 | MCP07 - Insufficient Authentication & Authorization | https://blog.truststrikelabs.com/posts/mcp07-insufficient-auth |
8 | MCP08 - Lack of Audit and Telemetry | https://blog.truststrikelabs.com/posts/mcp08-audit-telemetry |
9 | MCP09 - Shadow MCP Servers | |
10 | MCP10 - Context Injection & Over-Sharing | https://blog.truststrikelabs.com/posts/mcp10-context-oversharing |
Disclaimer
BrokenMCP is deliberately insecure. It exists so you can practice finding and fixing MCP vulnerabilities in a safe place. Never deploy it on a public network, and never reuse its code in production. Everything here is a lesson in what not to do.
Author
Built by TrustStrike Labs with love. Find our write-ups at blog.truststrikelabs.com.
This server cannot be deployed
Maintenance
ActivitySlowing
ResponsivenessNo issues
Related MCP Connectors
MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.
The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
An MCP server for deep research or task groups
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA deliberately vulnerable MCP application for learning MCP security through hands-on exercises covering OWASP MCP Top 10 categories.MIT
- FlicenseNot gradedqualityDmaintenanceA vulnerable MCP server designed for educational CTF challenges. It demonstrates various MCP security vulnerabilities in a controlled environment.8-
- FlicenseNot gradedqualityDmaintenanceAn intentionally vulnerable MCP server designed as a live demo target for the MCP Trust security scanner. It contains deliberate insecure patterns to demonstrate scanning capabilities.-