About Vulnerable MCP Server
Vulnerable MCP Server is an intentionally insecure application for security researchers testing SQL injection and remote code execution. It routes natural-language input through an Ollama LLM to raw SQL or shell commands and is intended only for isolated labs.
Key features
- 01Route requests using an LLM
- 02Execute SQL and terminal commands
- 03Initialize SQLite with sample data
- 04Expose pluggable JSON-RPC methods
- 05Designed for vulnerability testing
Use cases
- 01Test SQL injection in a lab
- 02Examine command execution risks
- 03Run security exercises in an isolated environment
MCP support
The project describes itself as an MCP server, but the README specifies a JSON-RPC API and does not describe MCP client-facing tools or resources. It is intentionally unauthenticated and unsafe; do not use it in production.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
We haven’t collected a package or remote endpoint for this server. Follow the instructions in the project README.
Tools
Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.
Details
From the project READMEVulnerable MCP Server
This project is an intentionally vulnerable MCP (Model Context Protocol) app, designed for security research.
DO NOT use in production environments.
It executes raw SQL and system commands with no authentication or restrictions.
⚙️ MCP SERVER
A command execution server that combines:
- FastAPI for the HTTP interface
- SQLite as a persistent database
- Ollama LLM to interpret natural language queries
- JSON-RPC as the main API protocol
This system routes natural language input to either SQL queries or shell commands, using a locally running LLM via Ollama.
Built to test SQL Injection (SQLi) and Remote Code Execution (RCE) vulnerabilities
via FastAPI, JSON-RPC, and LLM-based decision logic.
⚙️ WARNING: Security Notice
This app is intentionally insecure:
- ❗ No authentication or access control
- ❗ Accepts and executes raw SQL queries and shell commands
- ❗ No input validation
- ❗ LLM responses are blindly executed
Use only in isolated environments, CTFs, or research labs.
⚙️ Features
- LLM-based decision logic for command routing (SQL or CLI)
- Native execution of SQL and terminal commands
- Auto-initializing SQLite database with sample data
- Simple, pluggable JSON-RPC methods
- Vulnerable by design — suitable for offensive/defensive testing
⚙️ Installation
git clone https://github.com/your-repo/mcp-vulnerable-app.git
cd mcp-vulnerable-app
docker-compose up --build
docker network connect mcplab ollama
docker network connect mcplab mcp_internal
docker network connect mcplab mcp_remote
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.