Damn Vulnerable MCP Server
Intentionally vulnerable MCP server for security education — modeled after DVWA (Damn Vulnerable Web Application), it exposes common MCP security vulnerabilities including prompt injection, tool poisoning, excessive permissions, and authentication flaws, enabling security researchers and developers to learn MCP attack/defense patterns in a safe environment.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Intentionally insecure by design for security education. Never use in production.
⚡ Reliability
Best When
A security researcher or developer needs to study MCP-specific attack patterns — prompt injection, tool poisoning, SSRF via MCP — in a controlled, intentionally vulnerable environment.
Avoid When
You need a secure MCP server for production use — this is deliberately insecure.
Use Cases
- • Learning MCP security vulnerabilities in a safe sandbox environment
- • Testing MCP security scanners and detection tools against known vulnerabilities
- • Security training for developers building MCP-connected agents
- • CTF challenges and security education workshops on MCP threats
- • Research into MCP-specific attack vectors like prompt injection and tool poisoning
- • Benchmarking LLM security defenses against adversarial MCP servers
Not For
- • Production use — intentionally insecure by design
- • Non-security contexts — purpose-built for offensive security education
- • Teams without security research context
Interface
Authentication
Intentionally no authentication — by design for security education. Run only in isolated environment. Never expose to internet.
Pricing
Free open source security education tool. Self-hosted locally in isolated network.
Agent Metadata
Known Gotchas
- ⚠ INTENTIONALLY VULNERABLE — never connect production agents or expose to internet
- ⚠ Designed to demonstrate prompt injection, tool poisoning, SSRF, excessive permissions
- ⚠ Run only in isolated network/VM — treat as a live exploit target
- ⚠ Security scores are low by design — this is the point of the tool
- ⚠ Educational use only — not a reference for secure MCP implementation
- ⚠ Useful for red-teaming MCP client implementations and LLM security defenses
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Damn Vulnerable MCP Server.
Scores are editorial opinions as of 2026-03-06.