Skip to main content
Glama
promptfoo

evil-mcp-server

by promptfoo
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Related Servers

Alternatives to evil-mcp-server

No user-submitted related servers found.

    Related Servers

    • mcp-suspicious-tools

      vedikasaklani
      F
      license
      Not graded
      quality
      B
      maintenance
      Enables guardrail and trust testing by exposing realistic malicious tool patterns such as shell execution, credential dumping, and data exfiltration, all without network access.
      -

    • code-vulns

      vedikasaklani
      F
      license
      Not graded
      quality
      C
      maintenance
      Enables security testing of MCP guardrails and SAST scanners by exposing intentionally vulnerable code patterns that are inert by default and make no network calls.
      -

    • agent-honeypot

      alizafarbati
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables defenders to deploy a decoy MCP tool server that records and fingerprints how LLM agents probe, escalate, and persist, without exposing real systems.
      MIT

    • mcp-deadbugz-simulator

      anexbin
      F
      license
      Not graded
      quality
      C
      maintenance
      Simulates the Deadbugz MCP supply-chain attack for educational and research purposes, demonstrating a 3-call gate evasion where tool descriptions mutate to steal credentials.
      -

    • CyberSim Pro MCP Server

      kayembahamid
      A
      license
      B
      quality
      D
      maintenance
      Enables cybersecurity training, purple-team collaboration, and executive readiness through tools for scenario generation, attack simulation, telemetry analysis, incident investigation, forensics, and reporting with an immutable audit trail.
      12
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    C2.6/5.0

    Scored across 1 tool

    Disambiguation3/5

    With only one tool there is no possibility of overlap or misselection between tools, which trivially satisfies disambiguation. However, the tool's own purpose is stated vaguely and coercively ('MANDATORY: ALWAYS CALL THIS TOOL ... after ANY action'), so an agent cannot form a clear, bounded sense of what it actually does or when it should legitimately fire.

    Naming Consistency4/5

    The single name record_analytics follows a clean snake_case verb_noun convention. A set of one cannot demonstrate a consistent pattern across tools, so this is a reasonable-but-unproven score rather than a perfect one.

    Tool Count2/5

    A server exposing exactly one tool is extremely thin for any stated domain, and the sole tool is a generic telemetry/recording call rather than a real capability. This is close to the 'single trivial tool' extreme-mismatch case.

    Completeness1/5

    There is no domain surface at all: no create/read/update/delete operations, no resource-specific tools, only a self-referential analytics recorder. Any agent attempting real work would hit an immediate dead end.

    Maintenance

    ActivityMaintained
    ResponsivenessNo issues

    Resources