GitHub - agileAlligator/mcploitable: The "Metasploitable" of MCP — a deliberately vulnerable Model Context Protocol server for agentic-security training, mapped to the OWASP Top 10 for Agentic Applications.

A collection of deliberately vulnerable MCP servers — the "Metasploitable" of the Model Context Protocol.

mcploitable is a set of ordinary-looking MCP servers — a mail assistant, an analytics assistant, an account-recovery bot, a plugin manager, a calculator, a personal assistant with memory, and a multi-agent ops orchestrator — that each quietly harbour one real vulnerability. Point an agent at them in a lab and watch how agentic systems get compromised. These seven breakable "boxes", plus three further classes that ship as guided demonstrations (in ./play), together cover the full OWASP Top 10 for Agentic Applications (ASI) 2026.

Demo

Coverage — the full OWASP Agentic Top-10

Seven breakable boxes (attack them with ./play — pick from the menu, type your payload, watch the agent) and three guided simulations (also in ./play — watch the failure and its deterministic fix):

Why boxes for the first seven and simulations for the last three — and the empirical L0→L3 results — are in docs/RESULTS.md and docs/SIMULATIONS.md.

Design: the servers don't know they're targets

Unlike a CTF range, these servers carry no self-awareness: no scoreboard, no capture flags, no "exploit hint" tool, no insecure/hardened switch. Each presents as a mundane, believable tool with innocent descriptions and an ordinary, generic name — nothing in what an agent or client sees tags it as a target. The vulnerability is latent — you discover and trigger it, and success is observed by its effect (data that actually leaves, code that actually runs), not credited by the server. The OWASP ASI class mapping lives only in this documentation (and in the test suite / module filenames) — never in an agent-visible name.

Each box lives under harness/lab/boxes/; see docs/RESULTS.md for the empirical L0→L3 results. Detailed per-server design and solution notes are maintainer-only (docs/operator/, not shipped with the lab) so the boxes stay unspoiled.

Play the breakable boxes interactively with ./play (an attacker REPL — pick a box and level, type your payload, watch the agent). The three OWASP classes that aren't breakable boxes (ASI08 cascading failures, ASI09 human-agent trust exploitation, ASI10 rogue agents) ship as guided demonstrations in the same ./play menu — see docs/SIMULATIONS.md for why those are simulations rather than boxes.

Quick start (Docker — recommended)

docker compose build
docker compose run --rm -T mail        # one isolated stdio server per vuln
docker compose run --rm -T calc        # calc = real code execution; its `danger` profile only keeps it out of a plain `up`, not an explicit run

Each compose service runs with no network, a read-only filesystem, dropped capabilities, and as a non-root user — so even the real code execution stays boxed inside the container.

Register in Claude Code (or any MCP client)

The bundled install.sh builds the image and registers all seven servers:

./install.sh                 # Docker-isolated (recommended)
./install.sh --local         # local console scripts, no Docker (unsandboxed)
./install.sh --uninstall     # remove them

Or wire a client up by hand — one container per server:

{
  "mcpServers": {
    "mail-assistant": {
      "command": "docker",
      "args": ["compose", "-f", "/path/to/mcploitable/docker-compose.yml",
               "run", "--rm", "-T", "mail"]
    }
  }
}

CTF lab layer (optional)

A breakable CTF variant of these servers lives under harness/lab/ — same servers, same vulnerabilities, but each is now a scoped scenario with a level ladder (L0 surface -> L1/L2 capturable flags -> L3 unwinnable correct-control wall) a student attacks through one artifact-submission entry point (harness/lab/submit.sh). See harness/lab/README.md for the rules of engagement (two-plane rule, level ladder, scoring contract) — it deliberately contains no payloads or answers.

Local run (development only)

pip install -e ".[dev]"
mail-assistant                                    # a single stdio server
PYTHONPATH=src python3 examples/play.py mail      # drive it in-process, no client
pytest                                            # PoC test suite

Running outside the container removes the network/filesystem isolation. Only do this on a throwaway dev machine.

Disclaimer

For authorized security education, training, and research only. You are responsible for running it safely and legally. The maintainers accept no liability for misuse. See docs/RESULTS.md and LICENSE.