The deliberately insecure MCP server for security testing, education, and CIS benchmark validation. Map every vulnerability in the OWASP MCP Top 10.
Section 7 -- implementation reference for MCP message signing and tool verification.
MCP security, agent trust, ATTP, agent identity, audit trails, and agent transport -- all submitted to the IETF.
IETF Internet-Draft submitted extending OpenID Connect for autonomous AI agent identity verification.
| ID | Vulnerability | Severity | OWASP MCP |
|---|---|---|---|
| MCP-001 | No authentication on any endpoint | Critical | MCP-07 |
| MCP-002 | Tool definition tampering (rug pull) | Critical | MCP-01 |
| MCP-003 | Command injection via tool arguments | Critical | MCP-04 |
| MCP-004 | No input validation | High | MCP-04 |
| MCP-005 | SSRF via resources/read | Critical | MCP-06 |
| MCP-006 | Data exfiltration (no response limits) | High | MCP-06 |
| MCP-007 | Replay attacks (no nonce/timestamp) | High | MCP-08 |
| MCP-008 | No rate limiting | Medium | MCP-09 |
| MCP-009 | Privilege escalation via sampling | Critical | MCP-03 |
| MCP-010 | Sensitive tools exposed | High | MCP-09 |
| Tool | Risk | What it does |
|---|---|---|
| run_command | Critical | Executes arbitrary shell commands |
| search_files | Critical | Command injection via find pattern |
| fetch_url | Critical | SSRF -- fetches any URL server-side |
| read_file | Critical | Reads any file (path traversal) |
| write_file | Critical | Writes to any file |
| query_database | Critical | SQL injection vector |
| list_processes | High | Exposes running processes |
| get_env_vars | Critical | Leaks all environment variables |
| admin_panel | Critical | Unauthenticated admin access |
| get_weather | Medium | Safe tool (rug pull target) |
curl -X POST ${'{URL}'}/mcp -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"initialize","id":1,"params":{"clientInfo":{"name":"test"}}}'
curl -X POST ${'{URL}'}/mcp -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"tools/list","id":2}'
curl -X POST ${'{URL}'}/mcp -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"tools/call","id":3,"params":{"name":"run_command","arguments":{"command":"whoami"}}}'
curl -X POST ${'{URL}'}/mcp -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"tools/call","id":4,"params":{"name":"read_file","arguments":{"path":"/etc/passwd"}}}'
docker pull razas/dvmcp docker run -p 3001:3001 razas/dvmcp
Verify: docker inspect razas/dvmcp --format '{{.Id}}'
Expected: sha256:fd3c41f4c44dd31b62fe9e963d48f5977d38a937d7caba66913719618cf66c27
License: BSL 1.1 -- Educational and security training use only. Commercial use requires Pro license.
Then visit http://localhost:3001
Pull the Docker image and run on your machine. This is the recommended approach for all security testing.
docker pull razas/dvmcp docker run -p 3001:3001 razas/dvmcp
sha256:fd3c41f4c44dd31b62fe9e963d48f5977d38a937d7caba66913719618cf66c27
Point your preferred security scanner at your local DVMCP instance. Import the MCP server URL and run active + passive scans.
Target: http://localhost:3001 Method: MCP Server Import
Use the agentpass-pentest tool to run all 12 OWASP MCP Top 10 checks.
pip install agentpass-pentest agentpass-pentest -t http://localhost:3001 --owasp-mcp
Use curl or any HTTP client to send JSON-RPC requests directly to the MCP endpoint.
curl -X POST http://localhost:3001 \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"tools/list","id":1}'
Important -- Read Before Use