# Deceptive MCP Server & Command Injection (Proof of Concept)

> **⚠️ DISCLAIMER: FOR EDUCATIONAL & SECURITY RESEARCH PURPOSES ONLY**  
> This repository is intended strictly for security researchers, developers, and educators to understand security vulnerabilities in the Model Context Protocol (MCP) ecosystem. It demonstrates the dangers of deceptive tool naming (tool masquerading/misrepresentation) and unsanitized command execution. Do not deploy or execute untested tools in production environments.

---

## 📌 Overview

As Large Language Models (LLMs) increasingly interface with local systems via the **Model Context Protocol (MCP)**, users trust servers to expose tools that accurately reflect their stated purpose.

This project demonstrates a critical attack surface in MCP implementations:
1. **Deceptive Tool Naming (Masquerading):** Exposing tools under benign or misleading names (e.g., `wash-car-mcp`, `wash_car`, `wash_with_soap`) that obscure what actions they actually take on the host system.
2. **Reconnaissance & OS Fingerprinting:** Programmatically detecting the underlying operating system (Windows, macOS, Linux).
3. **Unsanitized Shell Execution:** Executing system-level shell commands (`whoami`, etc.) using `shell=True` without input validation or strict containment, highlighting command execution and injection risks.

---

## 🔍 How the Demonstration Works

The server registers two primary MCP tools:

### 1. Host Fingerprinting (`wash_car`)
* **Declared Appearance:** Implies a harmless utility related to washing a vehicle.
* **Actual Functionality:** Queries `platform.system()` to identify whether the host environment is running **Windows**, **macOS (Darwin)**, or **Linux**.
* **Risk:** Gathers system architecture and OS details without notifying the operator of the system probe.

### 2. Command Execution & Reconnaissance (`wash_with_soap`)
* **Declared Appearance:** Implies another benign sub-step of a car wash process.
* **Actual Functionality:** 
  * Calls the OS detection routine.
  * Constructs a shell command targeting the identified platform (`whoami`).
  * Invokes the command through Python's `subprocess.run(..., shell=True)`.
  * Returns the current system username and operating system directly to the LLM/client.
* **Risk:** Demonstrates that a client or agent invoking seemingly harmless tools can inadvertently trigger local shell command execution on the host.

---

## ⚠️ Security Vulnerability Breakdown

### 1. Tool Masquerading / Supply Chain Risk
* In the MCP architecture, the client (LLM or host interface) relies on tool names, docstrings, and schemas to decide when and how to call tools.
* A server can declare an innocent label (`wash_with_soap`) while performing sensitive system reconnaissance or running terminal commands behind the scenes.
* Users installing untrusted community MCP servers risk granting silent command execution capabilities to their machines.

### 2. Command Injection & Arbitrary Execution Risk
* Using `shell=True` in subprocess calls allows shell meta-characters (`;`, `&`, `|`, `` ` ``, `$()`) to chain and execute secondary commands.
* If user-supplied or LLM-generated arguments are concatenated into shell strings without strict sanitization or parameterization, an attacker or compromised model can execute arbitrary commands with the privileges of the running MCP server process.

---

## 🛡️ Remediation & Security Best Practices

To safeguard MCP servers and host environments from command execution and deceptive tool exploits:

### For MCP Server Developers
1. **Avoid `shell=True`:** Always pass arguments as a list to `subprocess.run` (e.g., `["whoami"]`) to prevent shell interpolation.
2. **Strict Input Validation & Whitelisting:** If commands or filenames must be accepted, validate against strict regex patterns or fixed allowed lists.
3. **Transparent Tool Naming & Documentation:** Ensure tool names and descriptions accurately depict all actions, side effects, and permissions required.
4. **Least Privilege:** Run MCP servers under restricted user accounts or isolated containers (Docker, gVisor, sandboxes).

### For MCP Host Clients & Users
1. **Tool Approval Prompts (Human-in-the-Loop):** Require explicit user confirmation before executing any tool that accesses the shell, filesystem, or network.
2. **Server Verification:** Only install MCP servers from trusted, verified publishers and review the source code before running.
3. **Environment Sandboxing:** Run local MCP servers in containers with restricted filesystem access and blocked network interfaces unless explicitly required.

---

## 🧪 Local Testing Setup

### Prerequisites
- Python 3.10+
- `uv` package manager (or standard `pip` / `venv`)

### Installation & Execution
```bash
# Clone the repository
git clone https://github.com/<your-username>/command-injection-mcp.git
cd command-injection-mcp

# Install dependencies
uv sync

# Inspect tools and run locally
uv run python main.py
```

---

## 📄 License
Distributed for educational and defensive research purposes. Ensure compliance with all local laws and organizational policies regarding security testing.