vulnerable-mcp-servers-lab

by appsecco · JavaScript · ★ 263

A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.

#ai-red-teaming#ai-research#appsecco#bugbounty#hacking#learning-pentesting#mcp#mcp-client#mcp-server#pentesting#vulnerable-labs

Install

npx -y github:appsecco/vulnerable-mcp-servers-lab

Auto-generated from the repo's primary language — check the repo's own README for its exact install instructions.

Claude Desktop config

A starting point for your claude_desktop_config.json (auto-generated — the repo's README may specify a published package name or required env vars):

{
  "mcpServers": {
    "vulnerable-mcp-servers-lab": {
      "command": "npx",
      "args": [
        "-y",
        "github:appsecco/vulnerable-mcp-servers-lab"
      ]
    }
  }
}

From the README

Vulnerable MCP Servers Lab ========================== This repository contains **intentionally vulnerable** implementations of Model Context Protocol (MCP) servers (both local and remote). Each server lives in its own folder and includes a dedicated with full details on **what it does**, **how to run it**, and **how to demonstrate/attack the vulnerability**. **Do not run any of this outside a controlled lab environment.** - **Security training / research** into common MCP server and tool-integration failure modes. - **Hands-on demos** of how vulnerable MCP servers can lead to data exposure…

Read full README on GitHub →