Vulnerable

vulnerable-MCP-server for education

python

0

GitHub Stars

python

Language

7 months ago

First Indexed

3 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "isaac-theori-vulnerable-mcp-server": {
      "command": "python",
      "args": [
        "run_server.py"
      ]
    }
  }
}

You are working with a vulnerable MCP Server used for security education. It demonstrates common MCP server weaknesses and how to develop safer implementations, test defenses, and perform secure auditing. This guide shows practical steps to run the server locally, experiment with interactive play, and execute vulnerability tests in a controlled environment.

How to use

You interact with the MCP Server through a client that communicates using the MCP protocol. You can run the server in a development mode to explore features, try out the interactive playground, and then run vulnerability tests in a safe sandbox. Use the client to send requests that exercise the server’s capabilities, observe responses, and understand how each vulnerability might be discovered and mitigated.

How to install

Prerequisites: ensure you have Python installed on your system. You also need a tooling option to run the MCP server in local mode.

# Install in editable mode using Python
pip install -e .

# Alternative: use UV to run the server in development mode
uv sync

When you are ready to start the server, you have two local (stdio) options. Pick one that matches your workflow.

uv run dev

or

python run_server.py


To explore an interactive playground and test vulnerabilities in a controlled way, run the following commands.

Interactive playground

uv run playground

Run vulnerability tests

python test_vulnerabilities.py

## Additional sections

Configuration and run flow details are focused on safe, educational usage. The server supports local development workfl ows via standard input/output (stdio) commands. You can start the server in development mode to observe how it behaves under different inputs and to study the impact of common weaknesses.

## Security notes and learning goals

Key learning goals include recognizing and understanding common MCP server vulnerabilities, their attack vectors, and how to implement safer coding practices. You will learn to apply input validation, sandboxed execution, and regular security reviews to reduce risk in MCP server deployments.