1. Conduid
  2. Developer Tools
  3. Vulnerable MCP Servers Lab
MCP server · Developer Tools

Vulnerable MCP Servers Lab

by · github.com/appsecco/vulnerable-mcp-servers-lab

A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.

Unclaimed MIT last commit 10 months ago learning-pentestingmcpappseccohackingai-red-teamingdevtoolsmcp-clientai-researchbugbounty
InstallView source
76Good

Scored 5 months ago · breakdown

About Vulnerable MCP Servers Lab

Vulnerable MCP Servers Lab is an MCP server published by appsecco in the Developer Tools category: a collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.

The repository has 281 stars and 60 forks, with the last commit 10 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/appsecco/vulnerable-mcp-servers-lab

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Vulnerable MCP Servers Lab

Powered by Claude · Grounded in docs

I know everything about Vulnerable MCP Servers Lab. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 7 hours ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • !No dynamic code executionSource scan found eval or shell execution. Review how tool inputs reach it before granting credentials.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

Vulnerable MCP Servers Lab

This repository contains intentionally vulnerable implementations of Model Context Protocol (MCP) servers (both local and remote). Each server lives in its own folder and includes a dedicated README.md with full details on what it does, how to run it, and how to demonstrate/attack the vulnerability.

Do not run any of this outside a controlled lab environment.

What this repo is for

  • Security training / research into common MCP server and tool-integration failure modes.
  • Hands-on demos of how vulnerable MCP servers can lead to data exposure, instruction injection, supply-chain compromise, and code execution.

Safety / lab guidance

  • Use a disposable VM/container and avoid using real secrets or personal data.
  • Prefer running on an isolated network; several servers make outbound network calls.
  • Treat all tool output and retrieved content as untrusted data.
  • If you expose any server over HTTP, assume it may be reachable/abused unless you add proper controls.

Getting started

  • Pick a server from the index below.
  • Open its per-server README and follow the instructions there.
  • Many servers include a claude_config.json snippet intended to be merged into Claude Desktop’s MCP configuration.

MCP servers in this repo

About Appsecco

Appsecco is a cybersecurity company specializing in product security testing, penetration testing, and security assessments. We hack SaaS products, AI Agents, MCP Servers and cloud/K8s infrastructure like attackers do, focusing on pragmatic, high-signal outcomes for real-world systems.

This lab repository exists to support security research and hands-on training for pentesters, who are on their journey to becoming AI Red Teamers, around MCP server vulnerabilities and the risks of integrating untrusted tools and untrusted content into AI agent workflows.

Contact

License

See LICENSE.

Links to Appsecco Resources

README fetched from the repository 7 hours ago. The original is authoritative.

Questions

About Vulnerable MCP Servers Lab

How do I install Vulnerable MCP Servers Lab?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Vulnerable MCP Servers Lab safe to use with an AI agent?

Its trust score is 76 out of 100 (good). It passes 3 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Vulnerable MCP Servers Lab still maintained?

The last commit was 10 months ago and 1 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.