No red flags found in any of the 11 categories — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against the SlowMist agent-security taxonomy, refreshed every 8 hours. Full audit →
by harishsg993010 · MCP Server · ★ 1.3k
Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h
🔒 Is damn-vulnerable-MCP-server safe to install? View the security audit →
Damn Vulnerable Model Context Protocol (DVMCP) A deliberately vulnerable implementation of the Model Context Protocol (MCP) for educational purposes. Overview The Damn Vulnerable Model Context Protocol (DVMCP) is an educational project designed to demonstrate security vulnerabilities in MCP implementations. It contains 10 challenges of increasing difficulty that showcase different types of vulnerabilities and attack vectors. This project is intended for security researchers, developers, and AI safety professionals to learn about potential security issues in MCP implementations and how to mitigate them. What is MCP? The Model Context Protocol (MCP) is a standardized protocol that allows applications to provide context for Large Language Models (LLMs) in a structured way. It separates the concerns of providing context from the actual LLM interaction, enabling applications to expose resources, tools, and prompts to LLMs. Recommended MCP Clients CLINE - VSCode Extension Refer to this Connecting to a Remote Server - Cline for connecting Cline with MCP server Quick Start Once you have cloned the repository, run the following commands: Disclaimer It's not stable in a Windows environment.
| Stars | 1,346 |
| Forks | 176 |
| Language | Python |
| Category | MCP Server |
| Quality Score | 62.6561022726492/100 |
| Open Issues | 24 |
| Last Updated | 2025-12-08 |
| Created | 2025-04-16 |
| Platforms | mcp, python |
| Est. Tokens | ~6k |
These tools work well together with damn-vulnerable-MCP-server for enhanced workflows:
Explore other popular mcp server tools:
damn-vulnerable-MCP-server is Damn Vulnerable MCP Server. It is categorized as a MCP Server with 1.3k GitHub stars.
damn-vulnerable-MCP-server is primarily written in Python.
You can find installation instructions and usage details in the damn-vulnerable-MCP-server GitHub repository at github.com/harishsg993010/damn-vulnerable-MCP-server. The project has 1.3k stars and 176 forks, indicating an active community.
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy, covering 11 red-flag categories including credential harvesting, data exfiltration, and curl | sh installers. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: