mcpsecurity
If you are the rightful owner of mcpsecurity and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
This project is an intentionally vulnerable MCP app designed for security research.
The Vulnerable MCP Server is a command execution server that integrates FastAPI for HTTP interfacing, SQLite for database management, and Ollama LLM for interpreting natural language queries. It uses JSON-RPC as the main API protocol to route natural language inputs to SQL queries or shell commands. This server is specifically built to test SQL Injection (SQLi) and Remote Code Execution (RCE) vulnerabilities through FastAPI, JSON-RPC, and LLM-based decision logic. It is crucial to note that this server is intentionally insecure, lacking authentication, access control, and input validation, making it suitable only for isolated environments, Capture The Flag (CTF) events, or research labs.
Features
- LLM-based decision logic for command routing (SQL or CLI)
- Native execution of SQL and terminal commands
- Auto-initializing SQLite database with sample data
- Simple, pluggable JSON-RPC methods
- Vulnerable by design — suitable for offensive/defensive testing
