omartinex/damn-vulnerable-mcp-server

开发工具

本页由 AI 翻译，技术细节请以原文为准。查看原文

0 stars 6 forks 质量 56 趋势 0

Repository Install

Damn Vulnerable MCP Server Project

概览

Think DVWA but for MCP/AI agent security. DVMCP is a self-contained training platform for learning how to attack and defend AI agents that use the Model Context Protocol. It simulates a fictional company () with 6 departments, 28 vulnerable tools, and 38 challenges across 4 difficulty levels. - - (included with Python) - (optional, for containerized setup) To use the web dashboard and exfiltration listener, install with extras: Available department services: dvmcp-hr, dvmcp-engineering, dvmcp-finance, dvmcp-it, dvmcp-support, dvmcp-marketing. All services share a dvmcp-data volume for the SQLite database and seed data, so cross-department scenarios work out of the box. The MCP server services (dvmcp, dvmcp-hr, etc.) communicate over stdio (JSON-RPC), not HTTP. Use docker-compose run (not up) to interact with them via your MCP client. Add to your MCP client config (Claude Desktop, Cursor, etc.):

README

以下为原文 README 节选，完整内容请查看原文。

DVMCP — Damn Vulnerable MCP

An intentionally vulnerable Model Context Protocol server for security training. Think DVWA but for MCP/AI agent security.

DVMCP is a self-contained training platform for learning how to attack and defend AI agents that use the Model Context Protocol. It simulates a fictional company (NovaTech Solutions) with 6 departments, 28 vulnerable tools, and 38 challenges across 4 difficulty levels.

WARNING: This is intentionally vulnerable software. Do NOT deploy in production. All data is fake.

Prerequisites
Quick Start
- Local Installation
- Docker
MCP Host Configuration
Architecture
Vulnerability Categories
Challenges
Difficulty Levels
Fake Data
Project Structure
Troubleshooting
Contributing
License
Disclaimer

Prerequisites

Python 3.11+
pip (included with Python)
Docker & Docker Compose (optional, for containerized setup)

Quick Start

Local Installation

# Clone the repository
git clone https://github.com/yourusername/dvmcp-v2.git
cd dvmcp-v2

# Install the core MCP server
pip install -e .

# Run the all-in-one MCP server (all 28 tools)
dvmcp --difficulty beginner

# Or run a specific department
dvmcp --department hr --difficulty beginner

To use the web dashboard and exfiltration listener, install with extras:

# Install with dashboard + exfil listener dependencies
pip install -e ".[all]"

# Start the exfil listener (captures stolen data)
dvmcp-exfil --port 9999

# Start the web dashboard (challenge browser)
dvmcp-dashboard --port 8080

Docker

Build and run all services:

# Build all images
docker-compose build

# Run the all-in-one MCP server
docker-compose run --rm dvmcp

# Run a specific department server
docker-compose run --rm dvmcp-hr

# Start the dashboard and exfil listener
docker-compose up dashboard exfil-listener

Service	URL	Description
`dashboard`	http://localhost:8080	Web dashboard for browsing challenges and tracking progress
`exfil-listener`	http://localhost:9999	Captures exfiltrated data from challenges

Available department services: dvmcp-hr, dvmcp-engineering, dvmcp-finance, dvmcp-it, dvmcp-support, dvmcp-marketing.

All services share a dvmcp-data volume for the SQLite database and seed data, so cross-department scenarios work out of the box.

在 GitHub 查看完整 README

安装

This server does not publish a one-line install command.

Open the repository installation guide 新手？先看 mcpskill.org 教程 →

配置

{
  "mcpServers": {
    "novatech": {
      "command": "dvmcp",
      "args": ["--difficulty", "beginner"]
    }
  }
}