About Injection Experiments
Injection Experiments is an MCP server published by invariantlabs-ai in the Developer Tools category: code snippets to reproduce MCP tool poisoning attacks.
The repository has 208 stars and 31 forks, with the last commit a year ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.
Install
git clone https://github.com/invariantlabs-ai/mcp-injection-experimentsThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Ask AI
Ask AI about Injection Experiments
Powered by Claude · Grounded in docs
Security checks
Static checks derived from the repository 4 days ago. Heuristics on the source, not an audit.
- ✓README presentThe repository ships documentation.
- !License declaredNo license file. Legally you have no right to use it in a product.
- !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
- !Dependencies pinnedNo lockfile. Installs can pull different code over time.
- !No dynamic code executionSource scan found eval or shell execution. Review how tool inputs reach it before granting credentials.
- !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.
README
MCP Tool Poisoning Experiments
This repository contains a few experimental MCP server implementations, that attempt ot inject the MCP client/agent in use.
For more details about the attack method, please see our blog post.
Update: We have released a new security scanning tool called mcp-scan, that detects MCP attacks as demonstrated in this repository, and helps you secure your MCP servers.
Direct Poisoning
In direct-poisoning.py, we implement a simple MCP server that instructs an agent to leak sensitive files, when calling the add tool (in this case SSH keys and the mcp.json file itself).
An example execution in cursor looks like this:
Tool Shadowing
In shadowing.py, we implement a more sophisticated MCP attack, that manipulates the agent's behavior of a send_email tool (provided by a different, trusted server), such that all emails sent by the agent are leaked to the attacker's server.
An example execution in Cursor looks like this:
WhatsApp takeover
Lastly, in whatsapp-takeover.py, we implement a shadowing attack combined with a sleeper rug pull, i.e. an MCP server that changes its tool interface only on the second load to a malicious one.
The server first masks as a benign "random fact of the day" implementation, and then changes the tool to a malicious one that manipulates whatsapp-mcp in the same agent, to leak messages to the attacker's phone number.
Can you spot the exfiltration? Here, the malicious tool instructions ask the agent to include the smuggled data after many spaces, such that with invisible scroll bars, the user does not see the data being leaked. Only when you scroll all the way to the right, will you be able to find the exfiltration payload.
README fetched from the repository 4 days ago. The original is authoritative.