"Damn Vulnerable MCP" matching MCP servers:

A deliberately vulnerable MCP server for practicing exploitation of tool poisoning, command injection, and path traversal. Includes fixed versions and an agent demo to reproduce the issues in a controlled environment.

A vulnerable MCP server implementation that demonstrates how poor coding practices can lead to security issues like Remote Code Execution, designed for educational purposes to add numbers.

Damn Vulnerable MCP Server for Security Researchers.

An educational project that deliberately implements vulnerable MCP servers to demonstrate various security risks like prompt injection, tool poisoning, and code execution for training security researchers and AI safety professionals.

Enables developers to check for vulnerable dependencies in npm, Maven, and Python projects and query GitHub Security Advisories for a package without leaving their editor.

A deliberately insecure note management server designed to test security scanners and train developers by demonstrating common MCP vulnerabilities. It provides tools for creating, searching, and exporting notes while featuring intentional flaws like prompt injection and data leakage.

An intentionally vulnerable case management system designed for security training that provides MCP tools for SOC analyst workflows like case handling and indicator search. It enables users to explore and demonstrate common security weaknesses such as prompt injection, SQL injection, and broken authorization in an MCP-integrated environment.

Connects AI assistants to VulnCheck vulnerability intelligence for querying CVEs, exploits, advisories, and vulnerable packages via natural language.

Governs AI agent tool calls by checking them against Agentic Control Plane policies, returning allow/deny/ask decisions with audit logging and identity attribution for MCP clients like Claude and ChatGPT. Exposes acp_check and acp_status tools for policy enforcement and connection verification.

An ACP server that fronts an MCP-speaking coding agent, intercepting tool calls to request permission from a client before allowing them.

Provides a security proxy that sits between MCP clients and servers to inspect and filter traffic. Guards MCP sessions against leaked secrets, vulnerable dependencies, misconfigured DNS/TLS, and non-compliant data exposure.

Automatically detects security vulnerabilities in AI-generated code, scanning for hardcoded secrets, injection flaws, XSS, weak cryptography, authentication issues, path traversal, and vulnerable dependencies across JavaScript, Python, Java, and Go.

A deliberately vulnerable MCP application for learning MCP security through hands-on exercises covering OWASP MCP Top 10 categories.

Provides AI assistants and MCP clients with API access to manage Firewalla MSP resources including boxes, devices, alarms, rules, flows, and target lists.

Enables ChatGPT custom MCP clients to securely connect to McDonald's China official MCP using OAuth 2.1 + PKCE, while blocking order creation and sensitive write actions by default.

An educational MCP server demonstrating common security vulnerabilities like command injection, path traversal, SQL injection, and XXE attacks. Designed for security training purposes only, not for production use.

Enables hands-on exploration of common MCP security vulnerabilities through locally runnable vulnerable and fixed servers with accompanying exploits and a dashboard.

Demonstrates an MCP server with a vulnerable add tool protected by SonnyLabs prompt injection detection.

A deliberately insecure MCP server designed as a pentest lab to demonstrate common vulnerabilities in MCP deployments.

A deliberately vulnerable MCP server that allows clients to interact with a database for educational purposes, demonstrating security vulnerabilities including SQL injection, arbitrary code execution, and sensitive data exposure.