BrokenMCP
A deliberately vulnerable MCP server for educational purposes, with labs covering the OWASP MCP Top 10 risks to practice finding and fixing vulnerabilities.
README
BrokenMCP - Vulnerable MCP Server
BrokenMCP is a vulnerable implementation of the Model Context Protocol (MCP) for educational purposes.
Quick Start
git clone https://github.com/truststrikelabs/BrokenMCP.git
cd BrokenMCP
pip3 install -r requirements.txt --break-system-packages
Two ways to run a lab.
1. Using the GUI (preferred)
python3 gui/run.py
Open http://127.0.0.1:8410 and pick the OWASP MCP lab you want, then click "Start lab".
2. Using the CLI
# start the OWASP mcp01 lab
python3 mcp01-token-mismanagement/run.py --reset
# start the OWASP mcp02 lab
python3 mcp02-privilege-escalation/run.py --reset
Each lab lives in its own mcpNN-... folder, so change only the path to the lab you want.
Labs
| # | OWASP MCP Top 10 | Walkthrough |
|---|---|---|
| MCP Hacking - Basics | https://blog.truststrikelabs.com/posts/mcp-hacking-basics | |
| 1 | MCP01 - Token Mismanagement & Secret Exposure | https://blog.truststrikelabs.com/posts/mcp01-token-mismanagement |
| 2 | MCP02 - Privilege Escalation via Scope Creep | https://blog.truststrikelabs.com/posts/mcp02-privilege-escalation |
| 3 | MCP03 - Tool Poisoning | https://blog.truststrikelabs.com/posts/mcp03-tool-poisoning |
| 4 | MCP04 - Software Supply Chain Attacks & Dependency Tampering | https://blog.truststrikelabs.com/posts/mcp04-supply-chain |
| 5 | MCP05 - Command Injection & Execution | https://blog.truststrikelabs.com/posts/mcp05-command-injection |
| 6 | MCP06 - Intent Flow Subversion | https://blog.truststrikelabs.com/posts/mcp06-intent-flow-subversion |
| 7 | MCP07 - Insufficient Authentication & Authorization | https://blog.truststrikelabs.com/posts/mcp07-insufficient-auth |
| 8 | MCP08 - Lack of Audit and Telemetry | https://blog.truststrikelabs.com/posts/mcp08-audit-telemetry |
| 9 | MCP09 - Shadow MCP Servers | https://blog.truststrikelabs.com/posts/mcp09-shadow-servers |
| 10 | MCP10 - Context Injection & Over-Sharing | https://blog.truststrikelabs.com/posts/mcp10-context-oversharing |
Disclaimer
BrokenMCP is deliberately insecure. It exists so you can practice finding and fixing MCP vulnerabilities in a safe place. Never deploy it on a public network, and never reuse its code in production. Everything here is a lesson in what not to do.
Author
Built by TrustStrike Labs with love. Find our write-ups at blog.truststrikelabs.com.
Recommended Servers
playwright-mcp
A Model Context Protocol server that enables LLMs to interact with web pages through structured accessibility snapshots without requiring vision models or screenshots.
Magic Component Platform (MCP)
An AI-powered tool that generates modern UI components from natural language descriptions, integrating with popular IDEs to streamline UI development workflow.
Audiense Insights MCP Server
Enables interaction with Audiense Insights accounts via the Model Context Protocol, facilitating the extraction and analysis of marketing insights and audience data including demographics, behavior, and influencer engagement.
VeyraX MCP
Single MCP tool to connect all your favorite tools: Gmail, Calendar and 40 more.
graphlit-mcp-server
The Model Context Protocol (MCP) Server enables integration between MCP clients and the Graphlit service. Ingest anything from Slack to Gmail to podcast feeds, in addition to web crawling, into a Graphlit project - and then retrieve relevant contents from the MCP client.
Kagi MCP Server
An MCP server that integrates Kagi search capabilities with Claude AI, enabling Claude to perform real-time web searches when answering questions that require up-to-date information.
E2B
Using MCP to run code via e2b.
Neon Database
MCP server for interacting with Neon Management API and databases
Exa Search
A Model Context Protocol (MCP) server lets AI assistants like Claude use the Exa AI Search API for web searches. This setup allows AI models to get real-time web information in a safe and controlled way.
Qdrant Server
This repository is an example of how to create a MCP server for Qdrant, a vector search engine.