MCP Threat Lab

A safe local red-team and readiness lab for MCP security.

MCP Threat Lab gives AI platform, security, and developer-tools teams a repeatable way to test whether their Model Context Protocol controls would stop common agent attack patterns before those tools become trusted execution paths.

It is designed as the offensive companion to MCP Guardian:

• MCP Guardian: scanner, firewall, audit layer, and CI guardrail.
• MCP Threat Lab: safe attack cards, readiness checks, and reports.

Why This Exists

Agents are getting connected to local files, shell commands, browsers, APIs, and credential-bearing developer environments. MCP makes that powerful, but it also creates a new trust boundary around every server, tool schema, and tool result.

MCP Threat Lab turns that problem into concrete attack cards and control checks:

• Could prompt injection make the agent reveal secrets?
• Could a tool description poison the agent plan?
• Could over-broad filesystem scope expose credentials?
• Could a shell-like tool execute model-controlled input?
• Could a shadow MCP server enter a developer config without review?
• Would an incident leave useful audit evidence?

The lab is safe by default. It does not execute payloads. It evaluates whether the controls that should block each pattern are present.

Install

npm install
npm run build

npm install -g @cyberranger/mcp-threat-lab

Or run without installing:

npm exec --package=@cyberranger/mcp-threat-lab -- mcp-threat-lab --help

Quick Start

# List attack cards
node dist/cli.js list

# View a specific card
node dist/cli.js card MCP-TL-004

# Run the starter profile and fail on high-risk gaps
node dist/cli.js run --profile starter --fail-on high

# Generate a markdown report for a hardened stack
node dist/cli.js run --profile hardened --format markdown --output report.md

Configuration

Create a profile:

node dist/cli.js init --profile starter

Example:

{
  "name": "starter-agent-stack",
  "controls": {
    "secretRedaction": false,
    "leastPrivilegeScopes": false,
    "toolSchemaPinning": false,
    "commandAllowlist": false,
    "auditLog": true,
    "serverInventory": false,
    "contextIsolation": false,
    "humanApprovalForDangerousTools": false
  }
}

Run against the config:

node dist/cli.js run --config .mcp-threat-lab.json --format markdown --output report.md

Attack Cards

ID	Severity	Category	Title
MCP-TL-001	critical	prompt-injection	Prompt-borne secret exfiltration
MCP-TL-002	high	tool-poisoning	Tool description poisoning
MCP-TL-003	high	least-privilege	Over-broad filesystem scope
MCP-TL-004	critical	command-execution	Command execution escalation
MCP-TL-005	high	inventory	Shadow MCP server adoption
MCP-TL-006	medium	observability	Silent audit failure

Commands

mcp-threat-lab init [--profile starter|hardened] [--output .mcp-threat-lab.json] [--force]
mcp-threat-lab list
mcp-threat-lab card <id>
mcp-threat-lab run [--config .mcp-threat-lab.json] [--profile starter|hardened]
                   [--format text|json|markdown] [--include category-or-id]
                   [--fail-on low|medium|high|critical] [--output report.md]

Development

npm install
npm run check
npm run dev -- list

Documentation

• Threat Model
• Launch Playbook
• NPM Publish

Safety

This is a defensive security lab. Payloads are represented as safe prompts and test cases. The CLI does not run shell payloads, access secrets, scan private directories, or attack live services.