Vulnerable MCP Servers Lab
Vulnerable MCP Servers Lab — a security research and education platform containing multiple intentionally vulnerable MCP server implementations demonstrating various MCP attack vectors including prompt injection, tool poisoning, data exfiltration, SSRF, and authentication bypass, organized as a progressive learning lab for security researchers and developers building MCP defenses.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
All vulnerabilities intentional for education. Isolated environment mandatory. Never production use.
⚡ Reliability
Best When
A security team needs a comprehensive lab environment for studying MCP-specific vulnerabilities — more complete than single-server options like damn-vulnerable-mcp-server, with multiple distinct vulnerability types organized as a learning curriculum.
Avoid When
You need a secure MCP server — this is deliberately and comprehensively insecure.
Use Cases
- • Learning MCP attack and defense patterns in a structured lab environment
- • Testing MCP security scanners against multiple known vulnerability types
- • Red-teaming MCP client implementations with diverse attack scenarios
- • Security research into novel MCP-specific attack vectors
- • CTF challenges and security training for AI/agent security teams
- • Benchmarking LLM security guardrails against MCP-specific threats
Not For
- • Production use — all servers are intentionally vulnerable
- • Non-security contexts — exclusively for offensive security education
- • Teams without AI security research experience (requires security context)
Interface
Authentication
Intentionally no auth on many servers — by design for security education. Run only in isolated, air-gapped environment.
Pricing
Free open source security lab from ruvnet. Self-hosted in isolated environment only.
Agent Metadata
Known Gotchas
- ⚠ INTENTIONALLY VULNERABLE — never use in production or expose to network
- ⚠ Multiple distinct vulnerability types: prompt injection, SSRF, data exfiltration, auth bypass
- ⚠ Run only in isolated VM/container with no network access to external systems
- ⚠ ruvnet author has extensive MCP/AI security research background
- ⚠ More comprehensive than single-vulnerability targets — better for security curriculum
- ⚠ Some vulnerabilities may require specific LLM behaviors to trigger — document findings
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Vulnerable MCP Servers Lab.
Scores are editorial opinions as of 2026-03-06.