Vulnerable MCP Servers Lab

This repository contains intentionally vulnerable implementations of Model Context Protocol (MCP) servers (both local and remote). Each server lives in its own folder and includes a dedicated README.md with full details on what it does, how to run it, and how to demonstrate/attack the vulnerability.

Do not run any of this outside a controlled lab environment.

What this repo is for

• Security training / research into common MCP server and tool-integration failure modes.
• Hands-on demos of how vulnerable MCP servers can lead to data exposure, instruction injection, supply-chain compromise, and code execution.

Safety / lab guidance

• Use a disposable VM/container and avoid using real secrets or personal data.
• Prefer running on an isolated network; several servers make outbound network calls.
• Treat all tool output and retrieved content as untrusted data.
• If you expose any server over HTTP, assume it may be reachable/abused unless you add proper controls.

Getting started

• Pick a server from the index below.
• Open its per-server README and follow the instructions there.
• Many servers include a claude_config.json snippet intended to be merged into Claude Desktop’s MCP configuration.

MCP servers in this repo

• Filesystem Workspace Actions (path traversal + code exec): Tools for reading/writing/listing a “workspace” plus Python execution; vulnerable to naive path joining and unsandboxed code execution.