F
licenseNot graded
qualityD
maintenanceA deliberately insecure MCP server designed as a pentest lab to demonstrate common vulnerabilities in MCP deployments.
-
BrokenMCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@BrokenMCPRun the MCP06 intent flow subversion lab and explain the vulnerability."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
BrokenMCP - Vulnerable MCP Server
BrokenMCP is a vulnerable implementation of the Model Context Protocol (MCP) for educational purposes.
Quick Start
git clone https://github.com/truststrikelabs/BrokenMCP.git
cd BrokenMCP
pip3 install -r requirements.txt --break-system-packagesTwo ways to run a lab.
1. Using the GUI (preferred)
python3 gui/run.pyOpen http://127.0.0.1:8410 and pick the OWASP MCP lab you want, then click "Start lab".
2. Using the CLI
# start the OWASP mcp01 lab
python3 mcp01-token-mismanagement/run.py --reset
# start the OWASP mcp02 lab
python3 mcp02-privilege-escalation/run.py --resetEach lab lives in its own mcpNN-... folder, so change only the path to the lab you want.
Related MCP server: MCP Goat
Labs
# | OWASP MCP Top 10 | Walkthrough |
MCP Hacking - Basics | ||
1 | MCP01 - Token Mismanagement & Secret Exposure | https://blog.truststrikelabs.com/posts/mcp01-token-mismanagement |
2 | MCP02 - Privilege Escalation via Scope Creep | https://blog.truststrikelabs.com/posts/mcp02-privilege-escalation |
3 | MCP03 - Tool Poisoning | |
4 | MCP04 - Software Supply Chain Attacks & Dependency Tampering | |
5 | MCP05 - Command Injection & Execution | https://blog.truststrikelabs.com/posts/mcp05-command-injection |
6 | MCP06 - Intent Flow Subversion | https://blog.truststrikelabs.com/posts/mcp06-intent-flow-subversion |
7 | MCP07 - Insufficient Authentication & Authorization | https://blog.truststrikelabs.com/posts/mcp07-insufficient-auth |
8 | MCP08 - Lack of Audit and Telemetry | https://blog.truststrikelabs.com/posts/mcp08-audit-telemetry |
9 | MCP09 - Shadow MCP Servers | |
10 | MCP10 - Context Injection & Over-Sharing | https://blog.truststrikelabs.com/posts/mcp10-context-oversharing |
Disclaimer
BrokenMCP is deliberately insecure. It exists so you can practice finding and fixing MCP vulnerabilities in a safe place. Never deploy it on a public network, and never reuse its code in production. Everything here is a lesson in what not to do.
Author
Built by TrustStrike Labs with love. Find our write-ups at blog.truststrikelabs.com.
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues
Related MCP Connectors
The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
An MCP server for deep research or task groups
Security research canary remote MCP server for owned-account testing.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA deliberately vulnerable MCP application for learning MCP security through hands-on exercises covering OWASP MCP Top 10 categories.MIT
- FlicenseNot gradedqualityDmaintenanceA vulnerable MCP server designed for educational CTF challenges. It demonstrates various MCP security vulnerabilities in a controlled environment.8-
- FlicenseNot gradedqualityCmaintenanceAn intentionally vulnerable MCP server designed as a live demo target for the MCP Trust security scanner. It contains deliberate insecure patterns to demonstrate scanning capabilities.-