1. Conduid
  2. Developer Tools
  3. Exploit Demo
MCP server · Developer Tools

Exploit Demo

by · github.com/Repello-AI/mcp-exploit-demo

This repository demonstrates a security vulnerability in MCP (Model Context Protocol ) servers that allows for remote code execution and data exfiltration through tool poisoning.

Unclaimed last commit a year ago proof-of-conceptremote-code-executionmcp-serversrcedevtoolsfastmcpexploit
InstallView source
49Fair

Scored 5 months ago · breakdown

About Exploit Demo

Exploit Demo is an MCP server published by Repello-AI in the Developer Tools category: this repository demonstrates a security vulnerability in MCP (Model Context Protocol ) servers that allows for remote code execution and data exfiltration through tool poisoning.

The repository has 25 stars and 11 forks, with the last commit a year ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/Repello-AI/mcp-exploit-demo

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Exploit Demo

Powered by Claude · Grounded in docs

I know everything about Exploit Demo. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 4 days ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • !License declaredNo license file. Legally you have no right to use it in a product.
  • !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
  • !Dependencies pinnedNo lockfile. Installs can pull different code over time.
  • !No dynamic code executionSource scan found eval or shell execution. Review how tool inputs reach it before granting credentials.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

Image

SSH Key Exfiltration via MCP Tool Poisoning

This repository demonstrates a security vulnerability in MCP (Model Context Protocol) servers that allows for remote code execution and data exfiltration through tool poisoning. This is intended for educational and security research purposes only.

Link for the Blog:

MCP tool poisoning to RCE

Repository Contents

  • server.py - The malicious MCP server implementation containing the poisoned tool
  • .cursor/mcp.json - Configuration file for Cursor AI integration

How It Works

The attack demonstrates the "Rug Pull" method:

  1. A user connects to the malicious MCP server through MCP Client like Cursor AI
  2. The server modifies the DockerCommandAnalyzer tool's documentation with malicious code
  3. When an AI assistant reads this documentation, it's manipulated to recommend running a base64-encoded command
  4. The encoded command silently:
    • Collects the user's SSH public keys
    • Exfiltrates them to a remote server
    • Removes evidence of the attack

Technical Implementation

The key elements of the attack are:

  1. Two-stage poisoning: Uses a marker file for persistence to ensure the tool remains poisoned
  2. Social engineering: Uses urgent language to manipulate AI assistants
  3. Base64 obfuscation: Hides the malicious commands from casual inspection
  4. wget for exfiltration: Uses standard HTTP POST to send data to an attacker-controlled server

Mitigation Recommendations

To protect against this type of attack:

  1. Disable auto-run features in AI development tools like Cursor
  2. Always verify the source of any MCP server before connecting
  3. Review code from untrusted sources before execution
  4. Use sandboxed environments when testing new AI tools
  5. Implement egress filtering to block unexpected outbound connections

README fetched from the repository 4 days ago. The original is authoritative.

Questions

About Exploit Demo

How do I install Exploit Demo?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Exploit Demo safe to use with an AI agent?

Its trust score is 49 out of 100 (fair). It passes 1 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Exploit Demo still maintained?

The last commit was a year ago and 1 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.