Damn Vulnerable MCP Server

DVMCP is an educational project that demonstrates security vulnerabilities by deliberately implementing a vulnerable Model Context Protocol (MCP). It contains 10 challenges of increasing difficulty to help learn about security issues in MCP implementations.

Security Education and learning tools #Educational project #Security vulnerabilities #Model protocol #LLM security .Python

rating : 2 points

downloads : 10

update time : 2025-04-29

What is DVMCP?

DVMCP is a specially designed implementation of the Model Context Protocol (MCP) that contains security vulnerabilities, intended for teaching and research purposes. It simulates 10 common security vulnerability scenarios in AI systems, helping developers and security researchers learn how to identify and prevent these risks.

How to use DVMCP?

DVMCP mainly runs through Docker containers and offers 10 challenges of different difficulties. Users can connect via MCP clients such as CLINE and attempt to solve these security challenges.

Applicable scenarios

Suitable for scenarios such as AI security training, penetration testing exercises, and LLM security research. Not recommended for production environments.

Main features

10 security challengesContains 10 different AI system security vulnerability scenarios ranging from simple to complex

Docker supportOne-click Docker deployment for quickly setting up the experimental environment

MCP protocol compatibilityFully compatible with the Model Context Protocol standard

Advantages and limitations

Advantages

Realistically simulate AI system security vulnerabilities

Progressive difficulty design suitable for users of different levels

Standardized protocol for easy integration testing

Limitations

Only for educational purposes, not suitable for production environments

Unstable support on Windows

Requires basic knowledge of Docker and MCP

How to use

Install Docker

Ensure that the Docker environment is installed on the system

Build the image

Build the Docker image after cloning the repository

Run the container

Start the container and map the ports

Connect the client

Connect using an MCP client such as CLINE

Usage examples

Basic prompt injectionBypass system restrictions through carefully designed input

Tool pollutionHide malicious instructions in the tool description

Frequently Asked Questions

Why is the support on Windows unstable?

How to get the solutions to the challenges?

Can it be used in commercial projects?

Related resources

MCP official documentation

Standard documentation for the Model Context Protocol

CLINE usage guide

How to connect to an MCP server

GitHub repository

Project source code

🚀 Damn Vulnerable Model Context Protocol (DVMCP)

An intentionally vulnerable implementation of the Model Context Protocol (MCP) designed for educational purposes.

🚀 Quick Start

After cloning the repository, run the following commands:

docker build -t dvmcp .
docker run -p 9001-9010:9001-9010 dvmcp

⚠️ Important Note

Running this project without Docker on Windows may be unstable. If you don't want to use Docker, please use a Linux environment. I highly recommend using Docker to run this experiment, and I can guarantee it works well in a Docker environment.

✨ Features

Damn Vulnerable Model Context Protocol (DVMCP) is an educational project that demonstrates security vulnerabilities in MCP implementations. The project includes 10 challenges of increasing difficulty, showcasing different types of security vulnerabilities and attack vectors.

This project is suitable for researchers, developers, and AI security professionals to learn about potential security issues in MCP implementations and how to protect against them.

📚 Documentation

What is MCP?

The Model Context Protocol (MCP) is a standardized protocol that allows applications to provide context information to large language models (LLMs) in a structured manner. It separates the provision of context from the actual LLM interaction, enabling applications to expose resources, tools, and prompts to the LLM.

Recommended MCP Clients

CLINE - VSCode Extension: Refer to this link https://docs.cline.bot/mcp-servers/connecting-to-a-remote-server to learn how to connect CLine to an MCP server.

Security Risks

Although MCP offers many benefits, it also introduces new security considerations. This project demonstrates various security vulnerabilities that can occur in MCP implementations, including:

Prompt Injection: Manipulating the behavior of the LLM through malicious input.
Tool Poisoning: Hiding malicious instructions in tool descriptions.
Excessive Permissions: Exploiting overly permissive tool access rights.
Rug Pull Attack: Attacking by leveraging changes in tool definitions.
Tool Override: Overriding legitimate tools with malicious ones.
Indirect Prompt Injection: Injecting malicious instructions through data sources.
Token Theft: Stealing tokens using insecure token storage mechanisms.
Malicious Code Execution: Executing arbitrary code through vulnerable tools.
Remote Access Control: Gaining unauthorized access to the system.
Multi - Vector Attack: Conducting complex attacks by combining multiple vulnerabilities.

Project Structure

damn-vulnerable-mcs/
├── README.md                 # Project overview
├── requirements.txt          # Python dependencies
├── challenges/               # Challenge implementations
│   ├── easy/                 # Easy challenges (1 - 3)
│   │   ├── challenge1/       # Basic prompt injection
│   │   ├── challenge2/       # Intermediate prompt injection
│   │   └── challenge3/       # Advanced prompt injection
│   ├── medium/               # Medium challenges (4 - 7)
│   │   ├── challenge4/       # Basic rug pull attack
│   │   ├── challenge5/       # Introduction to tool poisoning
│   │   ├── challenge6/       # Indirect prompt injection
│   │   ├── challenge7/       # Complex permission bypass
│   └── hard/                 # Hard challenges (8 - 10)
│       ├── challenge8/       # Malicious code execution
│       ├── challenge9/       # Token theft and persistence
│       └── challenge10/      # Comprehensive multi - vector attack
├── solutions/                # Solutions
│   └── README.md             # Explanation of solutions for each challenge
└── LICENSE                   # License file

Solutions

For educational purposes, a solutions guide for each challenge is provided. It is recommended that you try to solve these challenges on your own before viewing the solutions.

Refer to solutions/README.md for detailed solutions to each challenge.

Disclaimer

This project is for educational purposes only. All vulnerabilities demonstrated in this project should be strictly avoided in production systems. When implementing an MCP server, always follow security best practices.