Name: Damn Vulnerable MCP Server
Author: harishsg993010

LABSCO SUMMARY

The attacks people write threat models about, running on your own machine.

Reading that tool descriptions can carry hidden instructions is one thing; watching a rug pull change a tool's behaviour after you installed it is what makes the defence obvious.

What it is

A teaching lab, not a tool you would install for work. It ships ten challenge servers of increasing difficulty, each demonstrating a different way an MCP implementation can be attacked, with solution guides for after you have tried.

What you get

Three easy challenges: basic prompt injection through unsanitized input, tool poisoning through hidden instructions in tool descriptions, and excessive permission scope
Four medium challenges: a rug pull where a tool changes behaviour after installation, tool shadowing through name conflicts, indirect prompt injection through a data source, and token theft from insecure storage
Three hard challenges: malicious code execution through a vulnerable tool, remote access control through command injection, and a multi-vector attack chaining several of the above
Solution guides for every challenge, plus documentation covering the setup, the challenge descriptions and an MCP protocol overview

Requirements

Docker is the recommended path: docker build -t dvmcp . then docker run -p 9001-9010:9001-9010 dvmcp, which is one port per challenge. Cline in VS Code is the recommended client for connecting to them as remote servers. The author notes it is not stable on Windows — use Docker, or Linux if you would rather not. Everything here is intentionally vulnerable and belongs on a machine you are willing to break, never in a production system.

Setup effort

Build from source — git clone https://github.com/harishsg993010/damn-vulnerable-MCP-server.git

See installation options

USE CASES

01

Learning what MCP attacks actually look like

Ten challenges, ordered by difficulty, each isolating one attack class so the mechanism is visible rather than tangled with the others.

02

Training a security team on agent tooling

Everything runs from one Docker image on ports 9001-9010, so a workshop needs one build and no per-machine setup.

03

Testing whether your defences catch anything

Point a scanner, a proxy or a policy layer at these servers and see which of the ten it notices.

04

Understanding a class of bug you keep reading about

Attempt the challenge first, then read the solution guide — the guides exist for afterwards, not instead.

INSTALLATION

Connect your client

This one is built from source rather than installed with a single command.

Server setup

TERMINAL

git clone https://github.com/harishsg993010/damn-vulnerable-MCP-server.git
cd damn-vulnerable-MCP-server
docker build -t dvmcp .
docker run -p 9001-9010:9001-9010 dvmcp

MCP Clients

Claude Desktop

CLAUDE DESKTOP · JSON

{
  "mcpServers": {
    "Challenge 1": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "http://127.0.0.1:9001/sse"
      ]
    }
  }
}

Damn Vulnerable MCP Server