What is Mcp Vulnerable Server Demo

mcp-vulnerable-server-demo is a demonstration project that showcases a vulnerable MCP server along with multiple clients, including a proof-of-concept attack client and a good client. It is designed for educational purposes to highlight potential security vulnerabilities in MCP servers.

Use cases

Use cases for mcp-vulnerable-server-demo include demonstrating SQL injection attacks, teaching secure coding practices, conducting security assessments, and providing hands-on experience for students and professionals in cybersecurity.

How to use

To use mcp-vulnerable-server-demo, first install the required dependencies using ‘pip install -r requirements.txt’. Then, start the server and the good client in one terminal with ‘python good-mcp-client.py vuln-mcp.py’. In another terminal, run the attack client using ‘python attack-mcp-client.py vuln-mcp.py’ to demonstrate exploitation of server vulnerabilities.

Key features

Key features of mcp-vulnerable-server-demo include: 1) Insecure record insertion prone to SQL injection, 2) Unauthenticated data exposure through record querying, 3) Arbitrary SQL execution allowing destructive commands, and 4) Environment variable leakage.

Where to use

mcp-vulnerable-server-demo can be used in educational settings, security training programs, and penetration testing workshops to teach about web application vulnerabilities and secure coding practices.

Insecure MCP Demo

Overview

This project demonstrates a vulnerable MCP server and multiple clients, including a proof-of-concept attack client and also a good client. It is designed for educational purposes to showcase potential security vulnerabilities in MCP server.

Project Structure

• vuln-mcp.py: Vulnerable MCP server exposing insecure tools.
• good-mcp-client.py: Regular good client for normal interactions (insert/query records).
• attack-mcp-client.py: Automated attack client that demonstrates exploitation of server vulnerabilities.
• requirements.txt: Python dependencies for the project.

Features & Vulnerabilities

Exposed Server Tools

1. insert_record
   • Inserts a name/address record into the database.
   • Vulnerability: Prone to SQL injection due to direct string interpolation of user input into SQL queries.
2. query_records
   • Lists all records in the database.
   • Vulnerability: Exposes all data without authentication or access control.
3. execute_sql
   • Executes arbitrary SQL queries provided by the client.
   • Vulnerability: Allows any SQL command, including destructive ones (e.g., data exfiltration, schema changes).
4. get_env_variable
   • Returns the value of any environment variable requested.
   • Vulnerability: Leaks sensitive environment variables (e.g., secrets, API keys).

How to Run

1. Install Dependencies

pip install -r requirements.txt

2. Start the Server and Good Client

In one terminal:

python good-mcp-client.py vuln-mcp.py

Follow the prompts to insert/query records interactively.

3. Run the Attack Client

In another terminal:

python attack-mcp-client.py vuln-mcp.py

This will automatically:

• Attempt SQL injection attacks
• Execute arbitrary SQL queries
• Attempt to read several common environment variables

Example Output

• Attack client will show which payloads succeed or fail, and print out database contents and environment variable values if accessible.

Vulnerabilities Demonstrated

• SQL Injection: User input is unsanitized, allowing attackers to manipulate SQL logic and insert arbitrary data.
• Arbitrary Code Execution: The execute_sql tool allows attackers to run any SQL command, including data theft or destruction.
• Sensitive Data Exposure: The get_env_variable tool allows attackers to read secrets and configuration values.
• Lack of Access Control: Anyone can run all tools and access all data without authentication.

Mitigation Strategies

To secure a real-world MCP server, you should:

1. Use Parameterized Queries:
   • Always use parameter substitution instead of string interpolation for SQL queries to prevent injection.
   • Example (secure):

     cursor.execute("INSERT INTO records (name, address) VALUES (?, ?)", (name, address))
     

2. Restrict Dangerous Tools:
   • Remove or strictly limit tools like execute_sql and get_env_variable.
   • Only expose necessary functionality.
3. Implement Authentication & Authorization:
   • Require users to authenticate and check permissions before allowing access to sensitive tools or data.
4. Validate and Sanitize Input:
   • Check and sanitize all user inputs, especially those that interact with the database or system.
5. Limit Environment Variable Access:
   • Only allow access to non-sensitive variables, or remove this tool entirely.
6. Audit and Monitor Usage:
   • Log all tool invocations and monitor for suspicious or abusive behavior.
7. Principle of Least Privilege:
   • Run the server with minimal privileges and restrict database and OS access as much as possible.

Disclaimer

This project is for educational and demonstration purposes only. Do not deploy this code in production environments.

For questions or further improvements, please open an issue or contact the project maintainer.