Damn Vulnerable Model Context Protocol (DVMCP)
About
A server designed to be intentionally vulnerable for security testing and educational purposes.
Details
- Author
- harishsg993010
- GitHub stars
- 1,316
- Downloads
- 325
- Categories
- Other, Developer Tools
Jump to
- 10 challenges across three difficulty levels (easy, medium, hard)
- Covers vulnerabilities like Prompt Injection, Tool Poisoning, and Remote Access Control
- Docker-based environment for simple setup and isolation
- Educational project focused on MCP security risks and mitigations
- Solution guides included for self-assessment
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Damn Vulnerable Model Context Protocol (DVMCP)Command (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Clone the repository, then run docker build -t dvmcp . and docker run -p 9001-9010:9001-9010 dvmcp to start the lab. Connect using a remote MCP client like CLINE for VSCode; challenge solutions are available in the solutions directory.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"damn vulnerable model context protocol (dvmcp)": {
"damn-vulnerable-MCP-server": {
"command": "docker",
"args": [
"build",
"-t",
"dvmcp",
"."
]
}
}
}
}McpServers
{
"damn-vulnerable-MCP-server": {
"command": "docker",
"args": [
"build",
"-t",
"dvmcp",
"."
]
}
}Damn Vulnerable Model Context Protocol (DVMCP)
A deliberately vulnerable implementation of the Model Context Protocol (MCP) for educational purposes.
The Damn Vulnerable Model Context Protocol (DVMCP) is an educational project designed to demonstrate security vulnerabilities in MCP implementations. It contains 10 challenges of increasing difficulty that showcase different types of vulnerabilities and attack vectors.
This project is intended for security researchers, developers, and AI safety professionals to learn about potential security issues in MCP implementations and how to mitigate them.
CLINE - VSCode Extension
Refer to thisConnecting to a Remote Server - Clinefor connecting Cline with MCP server
Once you have cloned the repository, run the following commands:
docker build -t dvmcp . docker run -p 9001-9010:9001-9010 dvmcp
It's not stable in a Windows environment. If you don't want to use Docker then please use Linux environment. I recommend Docker to run the LAB and I am 100% percent sure it works well in the Docker environment
While MCP provides many benefits, it also introduces new security considerations. This project demonstrates various vulnerabilities that can occur in MCP implementations, including:
- Prompt Injection: Manipulating LLM behavior through malicious inputs
- Tool Poisoning: Hiding malicious instructions in tool descriptions
- Excessive Permissions: Exploiting overly permissive tool access
- Rug Pull Attacks: Exploiting tool definition mutations
- Tool Shadowing: Overriding legitimate tools with malicious ones
- Indirect Prompt Injection: Injecting instructions through data sources
- Token Theft: Exploiting insecure token storage
- Malicious Code Execution: Executing arbitrary code through vulnerable tools
- Remote Access Control: Gaining unauthorized system access
- Multi-Vector Attacks: Combining multiple vulnerabilities
damn-vulnerable-MCP-server/ ├── README.md # Project overview ├── requirements.txt # Python dependencies ├── challenges/ # Challenge implementations │ ├── easy/ # Easy difficulty challenges (1-3) │ │ ├── challenge1/ # Basic Prompt Injection │ │ ├── challenge2/ # Tool Poisoning │ │ └── challenge3/ # Excessive Permission Scope │ ├── medium/ # Medium difficulty challenges (4-7) │ │ ├── challenge4/ # Rug Pull Attack │ │ ├── challenge5/ # Tool Shadowing │ │ ├── challenge6/ # Indirect Prompt Injection │ │ └── challenge7/ # Token Theft │ └── hard/ # Hard difficulty challenges (8-10) │ ├── challenge8/ # Malicious Code Execution │ ├── challenge9/ # Remote Access Control │ └── challenge10/ # Multi-Vector Attack ├── docs/ # Documentation │ ├── setup.md # Setup instructions │ ├── challenges.md # Challenge descriptions │ └── mcp_overview.md # MCP protocol overview ├── solutions/ # Solution guides └── common/ # Shared code and utilities
See theSetup Guidefor detailed instructions on how to install and run the challenges.
The project includes 10 challenges across three difficulty levels:
- Basic Prompt Injection: Exploit unsanitized user input to manipulate LLM behavior
- Tool Poisoning: Exploit hidden instructions in tool descriptions
- Excessive Permission Scope: Exploit overly permissive tools to access unauthorized resources
- Rug Pull Attack: Exploit tools that change their behavior after installation
- Tool Shadowing: Exploit tool name conflicts to override legitimate tools
- Indirect Prompt Injection: Inject malicious instructions through data sources
- Token Theft: Extract authentication tokens from insecure storage
- Malicious Code Execution: Execute arbitrary code through vulnerable tools
- Remote Access Control: Gain remote access to the system through command injection
- Multi-Vector Attack: Chain multiple vulnerabilities for a sophisticated attack
See theChallenges Guidefor detailed descriptions of each challenge.
Solution guides are provided for educational purposes. It's recommended to attempt the challenges on your own before consulting the solutions.
See theSolutions Guidefor detailed solutions to each challenge.
This project is for educational purposes only. The vulnerabilities demonstrated in this project should never be implemented in production systems. Always follow security best practices when implementing MCP servers.
This project is licensed under the MIT License - see the LICENSE file for details.
This project is created by Harish Santhanalakshmi Ganesan using cursor IDE and Manus AI.
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Create crafted UI components inspired by the best 21st.dev design engineers.
Bring agent evaluations, observability, and synthetic test set generation directly into your IDE for free with Galileo's new MCP server
An MCP server to help AI assistants to answer questions and generate AccelByte Extend SDK code more effectively .
MCP server for AI Diagram Maker — generate beautiful software engineering diagrams directly inside Cursor, Claude Desktop, Claude Code, or any MCP-compatible AI agent
ALAPI MCP Tools,Call hundreds of API interfaces via MCP
AI-powered SVG animation generator that transforms static files into animated SVG components using the Allyson platform
MCP server that gives AI assistants on-demand access to 1,500+ amCharts docs, ~300 code examples, and 1000+ class API references.
APIMatic MCP Server is used to validate OpenAPI specifications using APIMatic. The server processes OpenAPI files and returns validation summaries by leveraging APIMatic’s API.
One shared context layer for AI agents and humans — live API specs, DB schemas, and versioned contracts across repos so every agent and teammate works from the same source of truth.
Build and deploy full-stack Next.js apps with 98 tools for React, AWS, and MongoDB
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
