Reading that tool descriptions can carry hidden instructions is one thing; watching a rug pull change a tool's behaviour after you installed it is what makes the defence obvious.
A teaching lab, not a tool you would install for work. It ships ten challenge servers of increasing difficulty, each demonstrating a different way an MCP implementation can be attacked, with solution guides for after you have tried.
- Three easy challenges: basic prompt injection through unsanitized input, tool poisoning through hidden instructions in tool descriptions, and excessive permission scope
- Four medium challenges: a rug pull where a tool changes behaviour after installation, tool shadowing through name conflicts, indirect prompt injection through a data source, and token theft from insecure storage
- Three hard challenges: malicious code execution through a vulnerable tool, remote access control through command injection, and a multi-vector attack chaining several of the above
- Solution guides for every challenge, plus documentation covering the setup, the challenge descriptions and an MCP protocol overview
Docker is the recommended path: `docker build -t dvmcp .` then `docker run -p 9001-9010:9001-9010 dvmcp`, which is one port per challenge. Cline in VS Code is the recommended client for connecting to them as remote servers. The author notes it is not stable on Windows — use Docker, or Linux if you would rather not. Everything here is intentionally vulnerable and belongs on a machine you are willing to break, never in a production system.