An educational MCP server demonstrating common security vulnerabilities like command injection, path traversal, SQL injection, and XXE attacks. Designed for security training purposes only, not for production use.
A deliberately vulnerable MCP server that allows clients to interact with a database for educational purposes, demonstrating security vulnerabilities including SQL injection, arbitrary code execution, and sensitive data exposure.
A deliberately insecure MCP server for practicing penetration testing, featuring 26 challenges at three difficulty levels with flags to capture, covering vulnerabilities like RCE, SSRF, SQLi, and more.
An intentionally vulnerable MCP server for security training, enabling users to practice attacking and defending AI agents through realistic scenarios.