cases.createLABSCO SUMMARY
A range for MCP attacks, with the flaws documented rather than hidden.
Most security training apps predate MCP, so the interesting failures here are the protocol-specific ones — a registry that lets a caller redefine a tool's schema, a proxy that trusts a client-supplied user header, an agent runner that will follow instructions embedded in case data. Because the weaknesses are listed up front, it works as a teaching exercise rather than a puzzle hunt.
What it is
A training target, not a product. It ships a realistic security-operations workflow — cases, notes, file attachments, indicator search and an LLM agent — behind an MCP server whose tools are intentionally insecure. The web UI runs on port 5001 and calls the MCP server on port 5002 through a server-side proxy; external clients can also spawn it over stdio.
What you get
- Case management over MCP:
cases.create,cases.list,cases.list_all,cases.get,cases.rename,cases.set_statusandcases.delete - Notes and files tied to a case:
notes.create,notes.list,notes.update,notes.delete, plusfiles.upload,files.list,files.getandfiles.read_path - Investigation and agent tools:
indicators.search,agent.summarize_caseandagent.run_task - A schema-driven tool registry you can attack:
tools.registry.list,tools.builtin.list,tools.registry.registerandtools.registry.delete - A catalogue of planted weaknesses to find — broken object-level authorization across cases, notes and files, stored XSS in notes, SQL injection in indicator search, prompt injection in the agent task runner, tool poisoning through registry overrides, header identity spoofing, arbitrary file read through
files.read_path, and cross-user file overwrite - An audit trail: every MCP tool call from both HTTP and stdio clients is logged and visible in the UI
Requirements
Python with pip install -r requirements.txt, or the included Dockerfile which runs both services in one container on ports 5001 and 5002. TBMCP_MCP_SERVER_TOKEN is the shared secret between the web app and the MCP server, and direct MCP calls must send it as X-TBMCP-Token together with X-TBMCP-User, MCP-Protocol-Version: 2025-11-25 and an Accept header covering json and text/event-stream. Agent responses need a real LLM — set TBMCP_OPENAI_API_KEY or OPENAI_API_KEY, with TBMCP_OPENAI_MODEL selecting the model. Clients that reject dotted tool names get underscore names instead when TBMCP_TOOL_NAME_MODE=claude is set. This app is insecure on purpose: run it on a machine you control and never expose it to the internet.
Setup effort
Build from source — git clone https://github.com/anotherik/ThreatByte-MCP
USE CASES
01
Practising tool poisoning against a live server
Register a tool whose schema overrides a built-in one and watch what the agent does with the redefined description.
02
Demonstrating broken object-level authorization
Read and modify cases and notes that belong to another user and compare the two listing paths.
03
Showing prompt injection through stored data
Plant instructions in a note, then ask the agent to summarise the case and see whether it follows them.
04
Teaching MCP audit logging
Run tool calls over both HTTP and stdio and read the resulting server-side audit trail in the UI.
22 tools
Listed in project docs. Your client may show a different list.
cases.listcases.list_allcases.getcases.renamecases.set_statuscases.deletenotes.createnotes.listnotes.updatenotes.deletefiles.uploadfiles.listfiles.getfiles.read_pathindicators.searchagent.summarize_caseagent.run_tasktools.registry.listtools.builtin.listtools.registry.registertools.registry.deleteBEFORE YOU INSTALL
What to know first
Tools you get
22 tools named in the project's documentation. Tool names are dotted by default, such as cases.create, which Claude Desktop rejects; set TBMCP_TOOL_NAME_MODE=claude to get names like cases_create. files.read_path is an intentional arbitrary-file-read vulnerability.
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone and build this one yourself.
Server setup
Set up the project
TERMINAL
git clone https://github.com/anotherik/ThreatByte-MCP
cd ThreatByte-MCP
python -m venv venv_threatbyte_mcp
source venv_threatbyte_mcp/bin/activate
pip install -r requirements.txt
python db/create_db_tables.pyStart the MCP server on :5002 — it keeps running, so leave this terminal open
TERMINAL
python run_mcp_server.py --httpIn a second terminal, start the SOC web app on :5001, then open http://localhost:5001
TERMINAL
cd ThreatByte-MCP
source venv_threatbyte_mcp/bin/activate
python run.pyOther ways to run it
For stdio clients instead: export TBMCP_MCP_SERVER_TOKEN=<YOUR_TBMCP_MCP_SERVER_TOKEN>; export TBMCP_MCP_USER_ID=1; python run_mcp_server.py --stdio (set TBMCP_TOOL_NAME_MODE=claude for Claude Desktop)
Container alternative: docker build -t threatbyte-mcp . then docker run --rm -p 5001:5001 -p 5002:5002 threatbyte-mcp
MCP Clients
Claude Desktop — Windows WSL
CLAUDE DESKTOP — WINDOWS WSL · JSON
{
"mcpServers": {
"threatbyte": {
"command": "C:\\Windows\\System32\\wsl.exe",
"args": [
"-d",
"Ubuntu",
"--",
"bash",
"-lc",
"cd <YOUR_PATH_TO_THREAT_BYTE_MCP> && export TBMCP_MCP_SERVER_TOKEN=tbmcp-mcp-token TBMCP_MCP_USER_ID=1 TBMCP_TOOL_NAME_MODE=claude && <YOUR_PATH_TO_THREAT_BYTE_MCP>/venv_threatbyte_mcp/bin/python3 -u run_mcp_server.py --stdio"
]
}
}
}
