F
license-
qualityC
maintenanceA deliberately insecure MCP server designed as a pentest lab to demonstrate common vulnerabilities in MCP deployments.
BrokenMCP
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@BrokenMCPRun the MCP06 intent flow subversion lab and explain the vulnerability."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
BrokenMCP - Vulnerable MCP Server
BrokenMCP is a vulnerable implementation of the Model Context Protocol (MCP) for educational purposes.
Quick Start
git clone https://github.com/truststrikelabs/BrokenMCP.git
cd BrokenMCP
pip3 install -r requirements.txt --break-system-packagesTwo ways to run a lab.
1. Using the GUI (preferred)
python3 gui/run.pyOpen http://127.0.0.1:8410 and pick the OWASP MCP lab you want, then click "Start lab".
2. Using the CLI
# start the OWASP mcp01 lab
python3 mcp01-token-mismanagement/run.py --reset
# start the OWASP mcp02 lab
python3 mcp02-privilege-escalation/run.py --resetEach lab lives in its own mcpNN-... folder, so change only the path to the lab you want.
Related MCP server: MCP Goat
Labs
# | OWASP MCP Top 10 | Walkthrough |
MCP Hacking - Basics | ||
1 | MCP01 - Token Mismanagement & Secret Exposure | https://blog.truststrikelabs.com/posts/mcp01-token-mismanagement |
2 | MCP02 - Privilege Escalation via Scope Creep | https://blog.truststrikelabs.com/posts/mcp02-privilege-escalation |
3 | MCP03 - Tool Poisoning | |
4 | MCP04 - Software Supply Chain Attacks & Dependency Tampering | |
5 | MCP05 - Command Injection & Execution | https://blog.truststrikelabs.com/posts/mcp05-command-injection |
6 | MCP06 - Intent Flow Subversion | https://blog.truststrikelabs.com/posts/mcp06-intent-flow-subversion |
7 | MCP07 - Insufficient Authentication & Authorization | https://blog.truststrikelabs.com/posts/mcp07-insufficient-auth |
8 | MCP08 - Lack of Audit and Telemetry | https://blog.truststrikelabs.com/posts/mcp08-audit-telemetry |
9 | MCP09 - Shadow MCP Servers | |
10 | MCP10 - Context Injection & Over-Sharing | https://blog.truststrikelabs.com/posts/mcp10-context-oversharing |
Disclaimer
BrokenMCP is deliberately insecure. It exists so you can practice finding and fixing MCP vulnerabilities in a safe place. Never deploy it on a public network, and never reuse its code in production. Everything here is a lesson in what not to do.
Author
Built by TrustStrike Labs with love. Find our write-ups at blog.truststrikelabs.com.
This server cannot be installed
Maintenance
–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- Alicense-qualityDmaintenanceA deliberately vulnerable MCP application for learning MCP security through hands-on exercises covering OWASP MCP Top 10 categories.MIT
- Flicense-qualityDmaintenanceA vulnerable MCP server designed for educational CTF challenges. It demonstrates various MCP security vulnerabilities in a controlled environment.8
- Flicense-qualityCmaintenanceAn intentionally vulnerable MCP server designed as a live demo target for the MCP Trust security scanner. It contains deliberate insecure patterns to demonstrate scanning capabilities.
Related MCP Connectors
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
An MCP server for deep research or task groups
Scans MCP servers for tool poisoning, prompt injection and supply chain risks.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/truststrikelabs/BrokenMCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server