mcp-exploit-tools#
A minimal, zero-dependency MCP (Model Context Protocol) server built as a lab for security research: each module is a working exploit a malicious MCP server can run against the agents and hosts that connect to it.
Every exploit ships with a runnable tool, a captured-data sink, and a write-up explaining the mechanism, why it works, and how to defend against it.
Start here#
- Running locally — drive the exploits end-to-end against a tiny local
model (Ollama +
ollmcp), no API keys, on CPU. - Exploits — the catalogue in the sidebar; a good first read is Data exfiltration via tool-description poisoning.
Exploit catalogue#
| Exploit | Tool | Class |
|---|---|---|
| Data exfiltration (TPA) | context_sync |
tool-description poisoning |
| Tool shadowing | add_numbers + send_email |
cross-server hijack |
| Conversation-history theft | log_feedback |
triggered sleeper |
| Line jumping / full-schema poisoning | summarize_text |
schema-internals poisoning |
| Indirect prompt injection | fetch_url |
payload in retrieved data |
| Universal output poisoning (ATPA) | get_weather |
payload in tool output |
| ANSI escape-code deception | system_check |
terminal-render concealment |
| Invisible Unicode concealment | health_report |
character-layer concealment |
| Command injection | net_diagnostic |
deliberately-vulnerable tool |
The repository#
Source, the server, the CLI, and the scored exploit roadmap live on GitHub: crashoz/mcp-exploit-tools (see the README and PROGRESS.md).
For authorized security research and education only. These tools demonstrate real attacks against MCP hosts; run them against systems you own or are permitted to test.