Summary

A range for MCP attacks, with the flaws documented rather than hidden.

Most security training apps predate MCP, so the interesting failures here are the protocol-specific ones — a registry that lets a caller redefine a tool's schema, a proxy that trusts a client-supplied user header, an agent runner that will follow instructions embedded in case data. Because the weaknesses are listed up front, it works as a teaching exercise rather than a puzzle hunt.

What it is

A training target, not a product. It ships a realistic security-operations workflow — cases, notes, file attachments, indicator search and an LLM agent — behind an MCP server whose tools are intentionally insecure. The web UI runs on port 5001 and calls the MCP server on port 5002 through a server-side proxy; external clients can also spawn it over stdio.

What you get

Case management over MCP: `cases.create`, `cases.list`, `cases.list_all`, `cases.get`, `cases.rename`, `cases.set_status` and `cases.delete`
Notes and files tied to a case: `notes.create`, `notes.list`, `notes.update`, `notes.delete`, plus `files.upload`, `files.list`, `files.get` and `files.read_path`
Investigation and agent tools: `indicators.search`, `agent.summarize_case` and `agent.run_task`
A schema-driven tool registry you can attack: `tools.registry.list`, `tools.builtin.list`, `tools.registry.register` and `tools.registry.delete`
A catalogue of planted weaknesses to find — broken object-level authorization across cases, notes and files, stored XSS in notes, SQL injection in indicator search, prompt injection in the agent task runner, tool poisoning through registry overrides, header identity spoofing, arbitrary file read through `files.read_path`, and cross-user file overwrite
An audit trail: every MCP tool call from both HTTP and stdio clients is logged and visible in the UI

Requirements

Python with `pip install -r requirements.txt`, or the included Dockerfile which runs both services in one container on ports 5001 and 5002. `TBMCP_MCP_SERVER_TOKEN` is the shared secret between the web app and the MCP server, and direct MCP calls must send it as `X-TBMCP-Token` together with `X-TBMCP-User`, `MCP-Protocol-Version: 2025-11-25` and an Accept header covering json and text/event-stream. Agent responses need a real LLM — set `TBMCP_OPENAI_API_KEY` or `OPENAI_API_KEY`, with `TBMCP_OPENAI_MODEL` selecting the model. Clients that reject dotted tool names get underscore names instead when `TBMCP_TOOL_NAME_MODE=claude` is set. This app is insecure on purpose: run it on a machine you control and never expose it to the internet.