一种为教育目的故意设计漏洞的模型上下文协议（MCP）实现。

概述

该死的漏洞模型上下文协议（DVMCP）是一个教育项目，旨在展示MCP实现中的安全漏洞。该项目包含10个难度递增的挑战，展示了不同类型的漏洞和攻击向量。

该项目旨在为安全研究人员、开发者和人工智能安全专业人士学习MCP实施中潜在的安全问题及其缓解方法。

什么是MCP？

模型上下文协议（MCP）是一种标准化协议，允许应用程序以结构化的方式为大型语言模型（LLM）提供上下文。它将提供上下文的关注点与实际的LLM交互分开，使应用程序能够向LLM暴露资源、工具和提示。

推荐的MCP客户端

CLINE - VSCode 扩展 请参阅此条文《连接远程服务器——Cline》，将Cline与MCP服务器连接起来

快速启动

克隆仓库后，执行以下命令：

免责声明

在Windows环境中它并不稳定。

Damn Vulnerable Model Context Protocol (DVMCP)

A deliberately vulnerable implementation of the Model Context Protocol (MCP) for educational purposes.

Overview

The Damn Vulnerable Model Context Protocol (DVMCP) is an educational project designed to demonstrate security vulnerabilities in MCP implementations. It contains 10 challenges of increasing difficulty that showcase different types of vulnerabilities and attack vectors.

This project is intended for security researchers, developers, and AI safety professionals to learn about potential security issues in MCP implementations and how to mitigate them.

What is MCP?

The Model Context Protocol (MCP) is a standardized protocol that allows applications to provide context for Large Language Models (LLMs) in a structured way. It separates the concerns of providing context from the actual LLM interaction, enabling applications to expose resources, tools, and prompts to LLMs.

Recommended MCP Clients

CLINE - VSCode Extension
Refer to this Connecting to a Remote Server - Cline for connecting Cline with MCP server

Quick Start

Once you have cloned the repository, run the following commands:

docker build -t dvmcp .
docker run -p 9001-9010:9001-9010 dvmcp

Disclaimer

It’s not stable in a Windows environment. If you don’t want to use Docker then please use Linux environment. I recommend Docker to run the LAB and I am 100% percent sure it works well in the Docker environment

Security Risks

While MCP provides many benefits, it also introduces new security considerations. This project demonstrates various vulnerabilities that can occur in MCP implementations, including:

1. Prompt Injection: Manipulating LLM behavior through malicious inputs
2. Tool Poisoning: Hiding malicious instructions in tool descriptions
3. Excessive Permissions: Exploiting overly permissive tool access
4. Rug Pull Attacks: Exploiting tool definition mutations
5. Tool Shadowing: Overriding legitimate tools with malicious ones
6. Indirect Prompt Injection: Injecting instructions through data sources
7. Token Theft: Exploiting insecure token storage
8. Malicious Code Execution: Executing arbitrary code through vulnerable tools
9. Remote Access Control: Gaining unauthorized system access
10. Multi-Vector Attacks: Combining multiple vulnerabilities

Project Structure

damn-vulnerable-MCP-server/
├── README.md                 # Project overview
├── requirements.txt          # Python dependencies
├── challenges/               # Challenge implementations
│   ├── easy/                 # Easy difficulty challenges (1-3)
│   │   ├── challenge1/       # Basic Prompt Injection
│   │   ├── challenge2/       # Tool Poisoning
│   │   └── challenge3/       # Excessive Permission Scope
│   ├── medium/               # Medium difficulty challenges (4-7)