1. Conduid
  2. AI
  3. Penetration Testing
MCP server · AI

Penetration Testing

by · github.com/Mr-Infect/MCP-Penetration-testing

The ultimate OWASP MCP Top 10 security checklist and pentesting framework for Model Context Protocol (MCP), AI agents, and LLM-powered systems.

Unclaimed last commit 8 months ago model-context-protocolmcp-securityai-securityai-red-teamingaiai-pentestingcybersecurityagent-securityllm-security
InstallView source
48Fair

Scored 3 months ago · breakdown

About Penetration Testing

Penetration Testing is an MCP server published by Mr-Infect in the AI category: the ultimate OWASP MCP Top 10 security checklist and pentesting framework for Model Context Protocol (MCP), AI agents, and LLM-powered systems. It has been installed 0 times through Conduid.

The repository has 9 stars and 2 forks, with the last commit 8 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues (0) before depending on it in production.

Install

Install
npx mcp-penetration-testing

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Penetration Testing

Powered by Claude · Grounded in docs

I know everything about Penetration Testing. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • ·README presentNot checked yet.
  • ·License declaredNot checked yet.
  • ·Tests presentNot checked yet.
  • ·Dependencies pinnedNot checked yet.
  • ·No dynamic code executionNot checked yet.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

🚀 MCP Master Checklist — The Gold Standard for MCP Security

If OWASP Top 10 is the law, this repository is the courtroom.

This repository is the world’s first # 1 end-to-end, checklist-driven, pentest-ready security framework dedicated exclusively to the OWASP Model Context Protocol (MCP) Top 10 – 2025.

Designed to be:

  • ✅ Auditor-defensible
  • ✅ Pentester-usable
  • ✅ Student-friendly
  • ✅ Enterprise-grade
  • ✅ Future-proof

🛡️ Badges (Because Credibility Matters)

🧠 What Makes This Repository EXTRAORDINARY?

✨ This is not documentation
✨ This is not theory
✨ This is not another blog dump

This repo is a:

  • 📌 Master Security Checklist
  • 📌 Pentesting Playbook
  • 📌 Audit & Compliance Framework
  • 📌 Learning Roadmap for MCP Security
  • 📌 Single Source of Truth for MCP Risks

Every MCP vulnerability includes:

  • Clear explanation
  • Attack surface mapping
  • Real-world failure scenarios
  • Detection techniques
  • Mitigation strategy
  • Pentester checklist
  • Scoring & evaluation logic

🎯 Covered Vulnerabilities (OWASP MCP Top 10 – 2025)

ID Vulnerability
MCP01 Token Mismanagement & Secret Exposure
MCP02 Privilege Escalation via Scope Creep
MCP03 Tool Poisoning
MCP04 Supply Chain Attacks & Dependency Tampering
MCP05 Command Injection & Execution
MCP06 Prompt Injection via Contextual Payloads
MCP07 Insufficient Authentication & Authorization
MCP08 Lack of Audit & Telemetry
MCP09 Shadow MCP Servers
MCP10 Context Injection & Over-Sharing

✔ Each item has its own deep-dive markdown
✔ Each item is pentest-aligned
✔ Each item is checklist-driven

🧪 MCP Master Checklist (The Crown Jewel 👑)

The MCP Master Checklist allows you to:

  • 🔍 Evaluate MCP systems objectively
  • 🧮 Calculate a numeric security score (/100)
  • 🏷️ Classify MCP maturity (Critical → Enterprise)
  • 📊 Track progress over time
  • 🛠️ Prioritize remediation efforts

If it’s not measurable, it’s not secure.

📊 Scoring & Maturity Model

Score Maturity Risk
0–30 🔴 Critical Immediate compromise likely
31–50 🟠 Weak Easily exploitable
51–70 🟡 Moderate Partial controls
71–85 🟢 Strong Well-secured
86–100 🟣 Enterprise Best-in-class

🎓 Who Should Use This?

✔ Cybersecurity Students
✔ Red Teamers & Pentesters
✔ SOC Analysts
✔ AI Engineers
✔ DevSecOps Teams
✔ Security Architects
✔ Auditors & GRC Teams
✔ Enterprises deploying AI agents

🧩 Repository Structure

📦 MCP-Master-Checklist
 ┣ 📂 MCP01-Token-Mismanagement
 ┣ 📂 MCP02-Privilege-Escalation
 ┣ 📂 MCP03-Tool-Poisoning
 ┣ 📂 MCP04-Supply-Chain-Attacks
 ┣ 📂 MCP05-Command-Injection
 ┣ 📂 MCP06-Prompt-Injection
 ┣ 📂 MCP07-Authentication-Authorization
 ┣ 📂 MCP08-Audit-Telemetry
 ┣ 📂 MCP09-Shadow-MCP-Servers
 ┣ 📂 MCP10-Context-OverSharing
 ┣ 📄 MCP-master-checklist.md
 ┗ 📄 README.md

🧠 Philosophy

LLMs are not secure by default. MCP expands the attack surface. Security must be designed — not assumed.

This repository exists to kill blind trust in AI systems.

🌟 Why This Will Be #1 on GitHub

  • 🔥 First MCP-only security checklist
  • 🔥 Direct OWASP MCP Top 10 mapping
  • 🔥 Pentest + Audit + Learning in one repo
  • 🔥 SEO-optimized structure & keywords
  • 🔥 Continuously evolving with MCP ecosystem

🤝 Contributing

Contributions are welcome and encouraged.

You can help by:

  • Adding labs
  • Improving detection logic
  • Adding tooling references
  • Submitting real-world MCP failure cases

📬 Open an issue or pull request.

☕ Support the Project

If this repository helped you:

  • ⭐ Star the repo
  • 🔁 Share it with your network
  • ☕ Buy me a coffee (link coming soon)

README mirrored from the source repository 3 months ago. The original is authoritative.

Questions

About Penetration Testing

How do I install Penetration Testing?

Run npx mcp-penetration-testing, then add the server to your MCP client's configuration. Conduid has recorded 0 installs, so the command is known to work with current clients.

Is Penetration Testing safe to use with an AI agent?

Its trust score is 48 out of 100 (fair). It passes 0 of 1 static security checks; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Penetration Testing still maintained?

The last commit was 8 months ago, with 0 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.