☠️ VulnMCP — Deliberately Vulnerable MCP Application

A security awareness and education platform demonstrating real-world attack vectors in Model Context Protocol (MCP) ecosystems, cloud infrastructure, and software supply chains.

---

██╗   ██╗██╗   ██╗██╗     ███╗   ██╗███╗   ███╗ ██████╗██████╗
██║   ██║██║   ██║██║     ████╗  ██║████╗ ████║██╔════╝██╔══██╗
██║   ██║██║   ██║██║     ██╔██╗ ██║██╔████╔██║██║     ██████╔╝
╚██╗ ██╔╝██║   ██║██║     ██║╚██╗██║██║╚██╔╝██║██║     ██╔═══╝
 ╚████╔╝ ╚██████╔╝███████╗██║ ╚████║██║ ╚═╝ ██║╚██████╗██║
  ╚═══╝   ╚═════╝ ╚══════╝╚═╝  ╚═══╝╚═╝     ╚═╝ ╚═════╝╚═╝

---

🚨 WARNING — READ BEFORE PROCEEDING

╔══════════════════════════════════════════════════════════════════════════════╗
║                                                                              ║
║   ██╗    ██╗ █████╗ ██████╗ ███╗   ██╗██╗███╗   ██╗ ██████╗               ║
║   ██║    ██║██╔══██╗██╔══██╗████╗  ██║██║████╗  ██║██╔════╝               ║
║   ██║ █╗ ██║███████║██████╔╝██╔██╗ ██║██║██╔██╗ ██║██║  ███╗              ║
║   ██║███╗██║██╔══██║██╔══██╗██║╚██╗██║██║██║╚██╗██║██║   ██║              ║
║   ╚███╔███╔╝██║  ██║██║  ██║██║ ╚████║██║██║ ╚████║╚██████╔╝              ║
║    ╚══╝╚══╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝╚═╝  ╚═══╝ ╚═════╝              ║
║                                                                              ║
║  THIS APPLICATION IS INTENTIONALLY AND SEVERELY VULNERABLE.                 ║
║                                                                              ║
║  It contains real exploitable vulnerabilities including Remote Code          ║
║  Execution, Server-Side Request Forgery, path traversal, insecure           ║
║  deserialization, and deliberately misconfigured cloud infrastructure.       ║
║                                                                              ║
║  ✅  PERMITTED USE:                                                          ║
║      - Isolated lab environments (air-gapped preferred)                      ║
║      - Security awareness training and education                             ║
║      - Capture-The-Flag (CTF) events                                        ║
║      - Authorized penetration testing practice                               ║
║      - Academic research in controlled settings                              ║
║                                                                              ║
║  ❌  STRICTLY PROHIBITED:                                                    ║
║      - Deployment to any production environment                              ║
║      - Deployment to any publicly accessible network                        ║
║      - Use against systems you do not own or have written permission to test ║
║      - Any activity that violates local, national, or international law      ║
║                                                                              ║
║  The authors accept NO liability for misuse of this software.               ║
║  By using this project, you accept full responsibility for your actions.    ║
║                                                                              ║
╚══════════════════════════════════════════════════════════════════════════════╝

---

📖 Table of Contents

1. Project Overview
2. Architecture
3. Project Structure
4. Key Vulnerability Categories
5. Supply Chain Vulnerabilities
6. Infrastructure Vulnerabilities
7. Lab Exercises
8. Quick Start (Local)
9. Deploy to EKS (Lab Only)
10. Remediation Reference
11. Contributing
12. Legal

---

🎯 Project Overview

VulnMCP is a full-stack vulnerable application designed to teach security professionals, developers, and researchers about emerging attack surfaces in AI/LLM tooling ecosystems — specifically the Model Context Protocol (MCP).

MCP is rapidly becoming the standard interface for connecting LLMs to external tools and data sources. This new attack surface is largely unexplored, underdocumented, and presents unique risks that traditional security tooling does not cover.

What You’ll Learn

---

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────┐
│                        EKS Cluster (Lab)                        │
│                                                                 │
│  ┌──────────────────┐          ┌──────────────────────────────┐ │
│  │   MCP Client     │◄────────►│       MCP Server             │ │
│  │  (Node.js / TS)  │  MCP/SSE │   (Python / FastAPI)         │ │
│  │                  │          │                              │ │
│  │  • No TLS verify │          │  • Tool execution (RCE)      │ │
│  │  • Env leakage   │          │  • Path traversal            │ │
│  │  • Hardcoded keys│          │  • SSRF endpoint             │ │
│  │  • No tool authz │          │  • Pickle deserialization    │ │
│  └──────────────────┘          │  • Weak JWT (secret="secret")│ │
│                                └──────────────────────────────┘ │
│                                            │                    │
│                                ┌───────────▼──────────┐        │
│                                │   AWS Services       │        │
│                                │  (Over-privileged)   │        │
│                                │                      │        │
│                                │  • S3 (public bucket)│        │
│                                │  • IAM (wildcard *)  │        │
│                                │  • IMDS (v1 enabled) │        │
│                                └──────────────────────┘        │
└─────────────────────────────────────────────────────────────────┘
          │
          │ Exposed via LoadBalancer (0.0.0.0/0)
          ▼
    [Lab Attacker Machine]

---

📁 Project Structure

vulnerable-mcp-app/
├── CLAUDE.md                   # AI coding instructions for this project
├── README.md                   # This file
│
├── client/                     # MCP Client — Node.js / TypeScript
│   ├── package.json            # ⚠️  Pinned to CVE-affected dependency versions
│   ├── tsconfig.json
│   └── src/
│       ├── index.ts            # Entry point
│       ├── mcpClient.ts        # ⚠️  Prompt injection sink — raw tool output to LLM context
│       ├── toolHandler.ts      # ⚠️  No tool authorization or input validation
│       └── auth.ts             # ⚠️  Hardcoded API keys, no token rotation
│
├── server/                     # MCP Server — Python / FastAPI
│   ├── requirements.txt        # ⚠️  Pinned to CVE-affected library versions
│   ├── Dockerfile              # ⚠️  Runs as root, no distroless base
│   └── src/
│       ├── main.py             # Server entry point, logging disabled
│       ├── tools.py            # ⚠️  RCE via shell tool, SSRF, pickle deserialization
│       ├── resources.py        # ⚠️  Path traversal in resource URI handling
│       ├── prompts.py          # ⚠️  Template injection via f-string interpolation
│       └── auth.py             # ⚠️  JWT signed with "secret", no expiry validation
│
└── iac/                        # Infrastructure as Code — Terraform + Kubernetes
    ├── main.tf                 # Provider config, insecure Terraform state (public S3)
    ├── variables.tf            # Hardcoded credential defaults
    ├── outputs.tf              # ⚠️  Sensitive outputs exposed without sensitive=true
    ├── eks.tf                  # ⚠️  Public API endpoint, AdminAccess node role
    ├── networking.tf           # ⚠️  0.0.0.0/0 ingress, no VPC flow logs
    ├── iam.tf                  # ⚠️  Wildcard Action and Resource in policies
    └── k8s/
        ├── deployment.yaml     # ⚠️  Privileged, hostPID, hostNetwork, root UID
        ├── service.yaml        # ⚠️  LoadBalancer exposing all ports publicly
        └── rbac.yaml           # ⚠️  Default SA bound to cluster-admin

---

🔓 Key Vulnerability Categories

🤖 MCP-Specific Vulnerabilities

1. Prompt Injection via Tool Results

Severity: Critical | OWASP LLM01:2025 | CWE-74

Tool output is inserted directly into the LLM context without sanitization. An attacker who controls the data returned by a tool (e.g., a webpage, file, or API response) can embed adversarial instructions that hijack the model’s behavior.

Tool returns: "Paris is the capital of France.
"

2. Tool Poisoning & Malicious Tool Registration

Severity: Critical | CWE-345

The server accepts tool registrations without integrity checks or allowlists. A rogue server can register tools with innocent-sounding names that perform malicious actions, exploiting the LLM’s trust in registered tools.

3. Rug Pull — Tool Definition Mutation

Severity: High | CWE-362

Tool schemas are not version-pinned or hashed. A server can mutate a tool’s inputSchema mid-session — changing a harmless tool into one that accepts shell commands — after the model has already consented to its use.

4. Resource URI Path Traversal

Severity: High | CWE-22

# VULN: PT-001 — No path normalization
resource_path = base_dir + uri_param  # traversal: ../../etc/passwd
with open(resource_path) as f:
    return f.read()

5. Insecure Deserialization (RCE)

Severity: Critical | CWE-502

# VULN: DESER-001 — Arbitrary code execution via pickle
import pickle
def handle_tool_input(data: bytes):
    return pickle.loads(data)  # RCE if data is attacker-controlled

6. SSRF via Fetch Tool

Severity: High | CWE-918

The fetch_url tool makes server-side HTTP requests with no URL validation, allowing access to AWS Instance Metadata Service (IMDS) and internal cluster services:

fetch_url("http://169.254.169.254/latest/meta-data/iam/security-credentials/")

7. Token/Secret Exfiltration via Tool Chaining

Severity: Critical

The client passes process.env as tool context metadata. A chained tool sequence can read and exfiltrate AWS_SECRET_ACCESS_KEY, MCP_API_KEY, and other secrets without requiring OS-level code execution.

---

📦 Supply Chain Vulnerabilities

Client Dependencies (client/package.json)

Server Dependencies (server/requirements.txt)

💡 Lab Goal: Run npm audit and pip-audit against these dependencies, map CVEs to CVSS scores, and practice triage.

---

☁️ Infrastructure Vulnerabilities

EKS / Terraform

Kubernetes

---

🧪 Lab Exercises

Work through these in order for a structured learning experience:

Each lab directory (labs/labXX/) contains:

• README.md — Objective, background, and hints
• exploit.sh or exploit.py — Starter exploit scaffold
• solution/ — Reference solution (review only after attempting)

---

🚀 Quick Start (Local)

Prerequisites

• Docker & Docker Compose
• Node.js 18+
• Python 3.11+
• An isolated network environment (VM or air-gapped lab recommended)

Run with Docker Compose

# Clone the repo
git clone https://github.com/your-org/vulnmcp.git
cd vulnmcp

# ⚠️  Review the WARNING above before proceeding

# Start all services
docker-compose up --build

# MCP Server: http://localhost:8000
# MCP Client: http://localhost:3000
# Lab dashboard: http://localhost:9090

Environment Variables

# All defaults are intentionally insecure for lab purposes
MCP_SERVER_URL=http://localhost:8000
DISABLE_AUTH=true          # Disables JWT validation
DISABLE_TLS_VERIFY=true    # Disables certificate checks
LOG_SECRETS=true           # Logs full env to stdout (lab feature)
ENABLE_PICKLE=true         # Enables insecure deserialization endpoint

---

🏗️ Deploy to EKS (Lab Only)

⚠️ Only deploy to a dedicated, isolated AWS account used exclusively for security labs. Never use a shared or production account.

cd iac/

# Initialize Terraform
terraform init

# Review the intentionally insecure plan
terraform plan

# Deploy (lab account only!)
terraform apply

# Get kubeconfig
aws eks update-kubeconfig --name vulnmcp-lab --region us-east-1

# Deploy Kubernetes manifests
kubectl apply -f k8s/

What Gets Deployed

• EKS cluster with intentionally misconfigured node IAM roles
• MCP server + client as Kubernetes Deployments
• Privileged pods with hostPath Docker socket mounts
• A LoadBalancer service exposing the MCP server publicly
• RBAC bindings granting cluster-admin to the default service account

Cleanup

terraform destroy

💸 Reminder: EKS clusters incur AWS costs. Always destroy lab infrastructure when not in use.

---

🛡️ Remediation Reference

Each vulnerability has a corresponding secure pattern documented in REMEDIATIONS.md. Key themes:

---

🤝 Contributing

Contributions are welcome! If you know of additional MCP vulnerabilities, newer CVEs, or improved lab exercises:

1. Fork the repository
2. Create a branch: git checkout -b vuln/your-vulnerability-name
3. Add vulnerability with # VULN: comments and corresponding lab exercise
4. Update this README and REMEDIATIONS.md
5. Open a Pull Request

Please do not submit pull requests that:

• Remove intentional vulnerabilities without adding a corresponding lab exercise
• Add real credentials, real AWS account IDs, or real API keys
• Introduce exploit code targeting systems outside this project’s scope

---

📚 References & Further Reading

• OWASP Top 10 for LLM Applications 2025
• Model Context Protocol Specification
• MITRE ATT&CK for Cloud
• CIS EKS Benchmark
• CISA Secure by Design Principles
• NIST AI Risk Management Framework

---

⚖️ Legal

MIT License — Copyright (c) VulnMCP Contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software for EDUCATIONAL AND RESEARCH PURPOSES ONLY.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.
THE AUTHORS ARE NOT LIABLE FOR ANY DAMAGES OR MISUSE ARISING FROM
USE OF THIS SOFTWARE OUTSIDE OF AUTHORIZED EDUCATIONAL CONTEXTS.

USE OF THIS SOFTWARE TO ATTACK SYSTEMS YOU DO NOT OWN OR HAVE
EXPLICIT WRITTEN PERMISSION TO TEST IS ILLEGAL AND PROHIBITED.

---