MCP Breach-to-Fix Labs

Hands-on lab of ten Model Context Protocol (MCP) challenges reproduced from real CVEs and public incident reports. I’ve run every exploit end-to-end with Cursor/Claude, so the steps aren’t theoretical—they’re the exact tool calls the assistants followed. Every scenario ships in two modes:

• Vulnerable - intentionally exploitable implementation you can reproduce end-to-end in Cursor/Claude Desktop.
• Secure - hardened implementation with defense-in-depth controls that block the attack.

These labs were fully battle-tested with Claude/Cursor, ensuring the exact exploit/mitigation flow is reproducible.

Each challenge includes Docker services, FastMCP servers, fixtures, and screenshots that prove the exploit really runs—no theoretical write-ups.

Challenge Catalog

Each challenge stores proof captures under challenges/-/screenshots/ or README for quick reference.

Getting Started

New to MCP? See the Setup Guide for detailed instructions on connecting Cursor, Claude Desktop, or MCP Inspector to the challenge servers.

Prerequisites

• Docker & Docker Compose
• Python 3.10+ (for local execution)
• Cursor or Claude Desktop (recommended for exploits)

Quick Start with Docker

Every challenge has vulnerable and secure Docker services:

# Example: Run the Git Command Injection vulnerable server
docker compose up git-command-injection-vulnerable

# Connect Cursor/Claude Desktop to http://localhost:8008/mcp/stream
# Follow the exploit walkthrough in 08-git-command-injection-ghsa-3q26-f695-pp76/README.md

# Compare with secure version
docker compose up git-command-injection-secure  # http://localhost:9008/mcp/stream

Local Python Execution

cd 08-git-command-injection-ghsa-3q26-f695-pp76
python -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate
pip install -r requirements.txt

# Run vulnerable server
python vulnerable/server.py

# Or secure server
python secure/server.py

Project Structure

01-Asana-multi-tenant-authorization-bypass/
  vulnerable/               # FastMCP server + Dockerfile
  secure/                   # Hardened implementation
  data/                     # Fixtures (projects.json)
  screenshots/              # Proof of exploit
  README.md                 # Detailed walkthrough

02-filesystem-prefix-bypass-cve-2025-53110/
  vulnerable/
  secure/
  files/                    # Test directories (safe_files, safe_files_sensitive)
  screenshots/
  README.md

... (8 more challenges)

docker-compose.yml          # All services configured

Philosophy

• Real exploits: Every README includes the exact MCP JSON-RPC payloads and Cursor/Claude commands to trigger the vulnerability
• Defense-in-depth: Secure builds demonstrate multiple security layers (input validation, path canonicalization, least privilege, etc.)
• Reproducible: Docker containers ensure consistent exploitation across environments
• Educational: Each challenge explains WHY the vulnerability exists and HOW the mitigations work

Contributing

Pull requests welcome! To add a new challenge:

1. Create -/ directory
2. Implement vulnerable/server.py and secure/server.py
3. Add Dockerfiles for both modes
4. Write comprehensive README.md with exploit walkthrough
5. Add services to docker-compose.yml
6. Capture screenshots of the exploit

---

⚠️ Warning: These servers are intentionally vulnerable. Never deploy them in production. Use only in isolated lab environments.