😎 Contributing

😎 Contributing

By Puliczek GitHub

🔥🔒 Awesome MCP (Model Context Protocol) Security 🖥️

security exploit
Overview

What is Awesome MCP Security?

Awesome MCP Security is a comprehensive resource dedicated to the security aspects of the Model Context Protocol (MCP), providing insights into potential vulnerabilities and security measures.

How to use Awesome MCP Security?

Users can explore various sections including papers, videos, articles, and code related to MCP security. The project encourages contributions and sharing of knowledge within the community.

Key features of Awesome MCP Security?

  • A curated list of research papers and articles on MCP security.
  • Video resources explaining security concerns and mitigation strategies.
  • Code examples and experiments related to MCP vulnerabilities.
  • Community-driven contributions and discussions.

Use cases of Awesome MCP Security?

  1. Understanding security vulnerabilities in MCP implementations.
  2. Learning about recent research and developments in MCP security.
  3. Contributing to the knowledge base of MCP security practices.

FAQ from Awesome MCP Security?

  • Is this project suitable for beginners in cybersecurity?

Yes! The resources are structured to cater to both beginners and experienced professionals.

  • Can I contribute to this project?

Absolutely! Contributions are welcome, and guidelines are provided in the contributing section.

  • Is there a risk in using the resources provided?

The project is intended for educational purposes only; misuse of the information is not the responsibility of the authors.

Content
🤝 Show your support - give a ⭐️ if you liked the content

Awesome MCP Security Awesome

Everything you need to know about Model Context Protocol (MCP) security.

Table of Contents

📔 Security Considerations

Official Security Considerations from the Official MCP Specification Rev: 2025-03-26

NOTE

15.04.2025: The current MCP auth specification is in progress of being replaced by a more robust specification. Please join the conversation if you have concerns around the current auth specification.

  • Servers MUST:
    • Validate all tool inputs
    • Implement proper access controls
    • Rate limit tool invocations
    • Sanitize tool outputs
  • Clients SHOULD:
    • Prompt for user confirmation on sensitive operations
    • Show tool inputs to the user before calling the server, to avoid malicious or accidental data exfiltration
    • Validate tool results before passing to LLM
    • Implement timeouts for tool calls
    • Log tool usage for audit purposes

WARNING

For trust & safety and security, clients MUST consider tool annotations to be untrusted unless they come from trusted servers.

WARNING

For trust & safety and security, there SHOULD always be a human in the loop* with the ability to deny tool invocations.

Applications SHOULD:

  • Provide UI that makes clear which tools are being exposed to the AI model.
  • Insert clear visual indicators when tools are invoked.
  • Present confirmation prompts to the user for operations, to ensure a human is in the loop.

NOTE

*Human-in-the-Loop (HITL) means that user help monitor and guide automated tasks, like deciding whether to accept tool requests in Cursor.

📃 Papers

📺 Videos

📕 Articles, X threads and Blog Posts

🧑‍🚀 Tools and code

💾 MCP Security Servers

💻 Other Useful Resources

😎 Contributing

👍🎉 First off, thanks for taking the time to contribute! 🎉👍

Please read and follow our contributing guide

Thanks! 🦄

🤝 Show your support

🤝 Show your support - give a ⭐️ if you liked the content

✔️ Disclaimer

This project can only be used for educational purposes. Using this resource against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.

No tools information available.
MCP Kali Server
MCP Kali Server by Wh0am123

MCP configuration to connect AI agent to a Linux machine.

security mcp
View Details
mcp-security-sandbox

MCP Security Playground - Hack with MCP Servers, MCP Clients. Try out different vulnerabilities and abuse LLMs and agents in a UI friendly experimentation lab

security playground
View Details
ZeroPath MCP Server
ZeroPath MCP Server by ZeroPathAI

Open-source MCP server for querying ZeroPath security issues, patches, and scans using Claude, Cursor, Windsurf, or any AI assistant.

security appsec
View Details
Arcjet - MCP Server

Arcjet Model Context Protocol (MCP) server. Help your AI agents implement bot detection, rate limiting, email validation, attack protection, data redaction.

security mcp
View Details
MCP Ethical Hacking

MCP Ethical Hacking Security sample for educational

security ai
View Details
MCP Subfinder Server
MCP Subfinder Server by copyleftdev

Model Context Protocol (MCP) server that wraps ProjectDiscovery's subfinder tool for powerful subdomain enumeration through a JSON-RPC API.

security mcp
View Details
🔒 MCP Server Authentication Reference Collection

🔒 Reference MCP servers that demo how authentication works with the current Model Context Protocol spec.

security authentication
View Details