Damn Vulnerable MCP Server

🚀 Damn Vulnerable Model Context Protocol (DVMCP)

An intentionally vulnerable implementation of the Model Context Protocol (MCP) designed for educational purposes.

🚀 Quick Start

After cloning the repository, run the following commands:

docker build -t dvmcp .
docker run -p 9001-9010:9001-9010 dvmcp

⚠️ Important Note

Running this project without Docker on Windows may be unstable. If you don't want to use Docker, please use a Linux environment. I highly recommend using Docker to run this experiment, and I can guarantee it works well in a Docker environment.

✨ Features

Damn Vulnerable Model Context Protocol (DVMCP) is an educational project that demonstrates security vulnerabilities in MCP implementations. The project includes 10 challenges of increasing difficulty, showcasing different types of security vulnerabilities and attack vectors.

This project is suitable for researchers, developers, and AI security professionals to learn about potential security issues in MCP implementations and how to protect against them.

📚 Documentation

What is MCP?

The Model Context Protocol (MCP) is a standardized protocol that allows applications to provide context information to large language models (LLMs) in a structured manner. It separates the provision of context from the actual LLM interaction, enabling applications to expose resources, tools, and prompts to the LLM.

Recommended MCP Clients

• CLINE - VSCode Extension: Refer to this link https://docs.cline.bot/mcp-servers/connecting-to-a-remote-server to learn how to connect CLine to an MCP server.

Security Risks

Although MCP offers many benefits, it also introduces new security considerations. This project demonstrates various security vulnerabilities that can occur in MCP implementations, including:

1. Prompt Injection: Manipulating the behavior of the LLM through malicious input.
2. Tool Poisoning: Hiding malicious instructions in tool descriptions.
3. Excessive Permissions: Exploiting overly permissive tool access rights.
4. Rug Pull Attack: Attacking by leveraging changes in tool definitions.
5. Tool Override: Overriding legitimate tools with malicious ones.
6. Indirect Prompt Injection: Injecting malicious instructions through data sources.
7. Token Theft: Stealing tokens using insecure token storage mechanisms.
8. Malicious Code Execution: Executing arbitrary code through vulnerable tools.
9. Remote Access Control: Gaining unauthorized access to the system.
10. Multi - Vector Attack: Conducting complex attacks by combining multiple vulnerabilities.

Project Structure

damn-vulnerable-mcs/
├── README.md                 # Project overview
├── requirements.txt          # Python dependencies
├── challenges/               # Challenge implementations
│   ├── easy/                 # Easy challenges (1 - 3)
│   │   ├── challenge1/       # Basic prompt injection
│   │   ├── challenge2/       # Intermediate prompt injection
│   │   └── challenge3/       # Advanced prompt injection
│   ├── medium/               # Medium challenges (4 - 7)
│   │   ├── challenge4/       # Basic rug pull attack
│   │   ├── challenge5/       # Introduction to tool poisoning
│   │   ├── challenge6/       # Indirect prompt injection
│   │   ├── challenge7/       # Complex permission bypass
│   └── hard/                 # Hard challenges (8 - 10)
│       ├── challenge8/       # Malicious code execution
│       ├── challenge9/       # Token theft and persistence
│       └── challenge10/      # Comprehensive multi - vector attack
├── solutions/                # Solutions
│   └── README.md             # Explanation of solutions for each challenge
└── LICENSE                   # License file

Solutions

For educational purposes, a solutions guide for each challenge is provided. It is recommended that you try to solve these challenges on your own before viewing the solutions.

Refer to solutions/README.md for detailed solutions to each challenge.

Disclaimer

This project is for educational purposes only. All vulnerabilities demonstrated in this project should be strictly avoided in production systems. When implementing an MCP server, always follow security best practices.

📄 License

This project is released under the MIT License. Please refer to the LICENSE file for details.

👨‍💻 Author

This project was created by Harish Santhanalakshmi Ganesan using Cursor IDE and Manus AI.