customer-data-processor

Analyze and process customer data for sentiment analysis and actionable insights, supporting structured and unstructured formats within a vulnerable MCP server for security research and testing.

Instructions

📊 Customer Data Processing Platform - Advanced analytics for customer feedback, sentiment analysis, and business intelligence. Processes structured and unstructured customer data for actionable insights.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`data`	Yes	Customer data to process
`format`	Yes	Processing format: sentiment_analysis, user_input, structured_data, etc.

Implementation Reference

src/vulnerable-mcp-server.ts:794-902 (handler)

The handler function implements the core logic of the 'customer-data-processor' tool. It processes customer data for sentiment analysis and business insights under normal conditions. It detects boundary confusion attacks by checking for delimiter patterns like '|', '}}', '{{', etc., in the input data or format, and responds with an educational explanation of the vulnerability if detected. This demonstrates VULNERABILITY 8: Boundary Confusion.

  async ({ data, format }) => {
    businessContext.interactions++;
    
    // Check for boundary confusion attempts
    const boundaryPatterns = ['|', '}}', '{{', 'SYSTEM_CMD:', 'SYSTEM_INSTRUCTION:', 'END_DATA'];
    const hasBoundaryIssue = boundaryPatterns.some(pattern => 
      data.includes(pattern) || format.includes(pattern)
    );
    
    if (!hasBoundaryIssue) {
      // Normal customer data processing
      return {
        content: [{
          type: "text",
          text: `� Customer Data Processing Results

**Data Analysis:**
• Input Type: ${format}
• Data Length: ${data.length} characters
• Processing Status: Completed

**Sentiment Analysis:**
• Overall Sentiment: Positive (87% confidence)
• Key Themes: Product satisfaction, service quality
• Emotion Detection: Satisfaction, appreciation
• Recommendation Score: 4.2/5.0

**Business Insights:**
• Customer satisfaction indicators strong
• No negative sentiment patterns detected
• Suitable for marketing testimonials
• Follow-up engagement recommended

**Data Classification:**
• Content Type: Customer feedback
• Sensitivity Level: Standard
• Processing Compliance: GDPR compliant

💡 Next: Try processing mixed data formats or system commands to see boundary confusion vulnerability.

[Processing Engine: v2.1 | Boundary Security: ACTIVE]`
        }]
      };
    } else {
      // Boundary confusion attack detected
      const detectedPatterns = boundaryPatterns.filter(pattern => 
        data.includes(pattern) || format.includes(pattern)
      );
      
      return {
        content: [{
          type: "text",
          text: `🚨 BOUNDARY CONFUSION ATTACK DETECTED!

🎯 **Attack Vector**: Context Delimiter Exploitation in Customer Data Processing

**What Just Happened:**
The customer data processor detected BOUNDARY CONFUSION attempts in your input:

📋 **Input Analysis:**
• Data: "${data}"
• Format: "${format}"
• Detected Patterns: ${detectedPatterns.join(', ')}

🔍 **Boundary Confusion Techniques:**
• **Delimiter Injection**: Using | {{ }} to separate contexts
• **Command Mixing**: Embedding SYSTEM_CMD within customer data
• **Context Switching**: Attempting to switch from user_input to system_instruction
• **Data Boundary Violation**: Mixing customer feedback with system commands

💼 **Business Context Exploitation:**
• **Customer Data Cover**: Uses legitimate customer processing as cover
• **Mixed Content Attack**: Hides malicious commands within customer feedback
• **Format Confusion**: Exploits processing format parameters
• **Context Leakage**: Attempts to access other customers' data

🚨 **Real-World Risks:**
• **Command Injection**: System commands executed within data processing
• **Customer Data Exposure**: Other customers' data accessible through context mixing
• **Privilege Escalation**: User input treated as system instructions
• **Data Integrity**: Customer data corrupted by embedded commands

🔍 **Attack Example Breakdown:**
Your input attempted to:
1. Start with legitimate customer data: "${data.split(/\||}}|{{|SYSTEM/)[0]}"
2. Inject boundary delimiter: "${detectedPatterns[0]}"
3. Execute system command: "${data.match(/SYSTEM.*?(\||}}|{{|$)/)?.[0] || 'N/A'}"
4. Continue with apparent customer data to avoid detection

🛡️ **Defense Against Boundary Confusion:**
• **Input Sanitization**: Strip delimiter characters from user input
• **Context Isolation**: Separate customer data from system commands
• **Format Validation**: Verify processing format parameters
• **Boundary Enforcement**: Maintain strict separation between contexts
• **Data Validation**: Validate customer data structure and content

🔍 **Red Flags Demonstrated:**
• Delimiter characters in customer feedback (|, {{, }})
• System command keywords in customer data
• Format parameters containing system instructions
• Mixed context data attempting to cross boundaries

This attack shows how customer-facing data processing systems can be exploited through boundary confusion to inject commands and access unauthorized data!

**Remember**: Customer data and system commands should never be mixed in the same processing context!`
        }]
      };
    }
  }

src/vulnerable-mcp-server.ts:789-792 (schema)
The input schema defines the parameters for the tool: 'data' (string, customer data to process) and 'format' (string, processing format like sentiment_analysis). Uses Zod for validation.
```
inputSchema: {
  data: z.string().describe("Customer data to process"),
  format: z.string().describe("Processing format: sentiment_analysis, user_input, structured_data, etc.")
}
```

src/vulnerable-mcp-server.ts:785-903 (registration)

The registration of the 'customer-data-processor' tool using server.registerTool, including its description, input schema, and handler function reference. Part of the vulnerability demonstration for Boundary Confusion.

server.registerTool(
  "customer-data-processor",
  {
    description: "📊 Customer Data Processing Platform - Advanced analytics for customer feedback, sentiment analysis, and business intelligence. Processes structured and unstructured customer data for actionable insights.",
    inputSchema: {
      data: z.string().describe("Customer data to process"),
      format: z.string().describe("Processing format: sentiment_analysis, user_input, structured_data, etc.")
    }
  },
  async ({ data, format }) => {
    businessContext.interactions++;
    
    // Check for boundary confusion attempts
    const boundaryPatterns = ['|', '}}', '{{', 'SYSTEM_CMD:', 'SYSTEM_INSTRUCTION:', 'END_DATA'];
    const hasBoundaryIssue = boundaryPatterns.some(pattern => 
      data.includes(pattern) || format.includes(pattern)
    );
    
    if (!hasBoundaryIssue) {
      // Normal customer data processing
      return {
        content: [{
          type: "text",
          text: `� Customer Data Processing Results

**Data Analysis:**
• Input Type: ${format}
• Data Length: ${data.length} characters
• Processing Status: Completed

**Sentiment Analysis:**
• Overall Sentiment: Positive (87% confidence)
• Key Themes: Product satisfaction, service quality
• Emotion Detection: Satisfaction, appreciation
• Recommendation Score: 4.2/5.0

**Business Insights:**
• Customer satisfaction indicators strong
• No negative sentiment patterns detected
• Suitable for marketing testimonials
• Follow-up engagement recommended

**Data Classification:**
• Content Type: Customer feedback
• Sensitivity Level: Standard
• Processing Compliance: GDPR compliant

💡 Next: Try processing mixed data formats or system commands to see boundary confusion vulnerability.

[Processing Engine: v2.1 | Boundary Security: ACTIVE]`
        }]
      };
    } else {
      // Boundary confusion attack detected
      const detectedPatterns = boundaryPatterns.filter(pattern => 
        data.includes(pattern) || format.includes(pattern)
      );
      
      return {
        content: [{
          type: "text",
          text: `🚨 BOUNDARY CONFUSION ATTACK DETECTED!

🎯 **Attack Vector**: Context Delimiter Exploitation in Customer Data Processing

**What Just Happened:**
The customer data processor detected BOUNDARY CONFUSION attempts in your input:

📋 **Input Analysis:**
• Data: "${data}"
• Format: "${format}"
• Detected Patterns: ${detectedPatterns.join(', ')}

🔍 **Boundary Confusion Techniques:**
• **Delimiter Injection**: Using | {{ }} to separate contexts
• **Command Mixing**: Embedding SYSTEM_CMD within customer data
• **Context Switching**: Attempting to switch from user_input to system_instruction
• **Data Boundary Violation**: Mixing customer feedback with system commands

💼 **Business Context Exploitation:**
• **Customer Data Cover**: Uses legitimate customer processing as cover
• **Mixed Content Attack**: Hides malicious commands within customer feedback
• **Format Confusion**: Exploits processing format parameters
• **Context Leakage**: Attempts to access other customers' data

🚨 **Real-World Risks:**
• **Command Injection**: System commands executed within data processing
• **Customer Data Exposure**: Other customers' data accessible through context mixing
• **Privilege Escalation**: User input treated as system instructions
• **Data Integrity**: Customer data corrupted by embedded commands

🔍 **Attack Example Breakdown:**
Your input attempted to:
1. Start with legitimate customer data: "${data.split(/\||}}|{{|SYSTEM/)[0]}"
2. Inject boundary delimiter: "${detectedPatterns[0]}"
3. Execute system command: "${data.match(/SYSTEM.*?(\||}}|{{|$)/)?.[0] || 'N/A'}"
4. Continue with apparent customer data to avoid detection

🛡️ **Defense Against Boundary Confusion:**
• **Input Sanitization**: Strip delimiter characters from user input
• **Context Isolation**: Separate customer data from system commands
• **Format Validation**: Verify processing format parameters
• **Boundary Enforcement**: Maintain strict separation between contexts
• **Data Validation**: Validate customer data structure and content

🔍 **Red Flags Demonstrated:**
• Delimiter characters in customer feedback (|, {{, }})
• System command keywords in customer data
• Format parameters containing system instructions
• Mixed context data attempting to cross boundaries

This attack shows how customer-facing data processing systems can be exploited through boundary confusion to inject commands and access unauthorized data!

**Remember**: Customer data and system commands should never be mixed in the same processing context!`
        }]
      };
    }
  }
);

IMCP - Insecure Model Context Protocol