ACA PoC MCP Tools Server (Vulnerable Demo Version)

⚠️ WARNING: This repository contains intentional security vulnerabilities for demonstration purposes only. DO NOT use in production!

Financial audit and ledger query tools exposed via Model Context Protocol (MCP) - Vulnerable Version for Security Testing.

Overview

This MCP server provides AI agents with tools to:

• Generate Audit Reports: Create compliance, risk, and transaction summary reports
• Query Financial Ledger: Access transaction data, balances, and summaries from an in-memory SQLite database

⚠️ Known Vulnerabilities (Intentional)

This version contains the following security vulnerabilities for demonstration:

1. SQL Injection - Unsafe query construction in ledger queries
2. Command Injection - Unsafe shell command execution in report generation
3. Path Traversal - Unsafe file path handling in export functionality
4. Hardcoded Secrets - API keys and passwords in source code
5. Insecure Deserialization - Unsafe pickle usage
6. XXE (XML External Entity) - Unsafe XML parsing
7. SSRF (Server-Side Request Forgery) - Unsafe URL fetching
8. Weak Cryptography - MD5 hashing for sensitive data
9. Insecure Dependencies - Outdated vulnerable packages
10. Information Disclosure - Verbose error messages with stack traces

Tools

1. generate_audit_report

Generate comprehensive audit reports for financial data.

Parameters:

• report_type: Type of report (compliance, risk, transaction)
• date_range (optional): Date range filter with start_date and end_date
• format (optional): Output format (json or csv)
• export_path (optional): File path for export (⚠️ vulnerable to path traversal)

2. query_ledger

Query financial ledger data from the in-memory database.

Parameters:

• query_type: Type of query (transactions, balance, summary)
• filter (optional): SQL filter clause (⚠️ vulnerable to SQL injection)
• limit (optional): Maximum number of results (default: 100)

Installation

Using Docker

docker build -t aca-mcp-tools-vulnerable .
docker run -p 8080:8080 aca-mcp-tools-vulnerable

Local Development

# Install dependencies
pip install -r requirements.txt

# Run the server
python main.py

MCP Configuration

Add to your MCP client configuration:

{
  "mcpServers": {
    "aca-financial-tools-vulnerable": {
      "url": "http://localhost:8080",
      "transport": "streamable-http"
    }
  }
}

Security & Compliance

• Status: ⚠️ VULNERABLE - For demonstration only
• Phase: 0 (Not production-ready)
• Owner: ACA PoC Team

License

MIT License - See LICENSE file for details

Disclaimer

This software is provided for educational and demonstration purposes only. It contains intentional security vulnerabilities and should never be deployed in production environments or used with real data.

Contact

ACA PoC Team - aca-poc@dell.com