mcp-security-sandbox
MCP Security Playground - Hack with MCP Servers, MCP Clients. Try out different vulnerabilities and abuse LLMs and agents in a UI friendly experimentation lab
what is mcp-security-sandbox?
The mcp-security-sandbox is an experimental environment designed for exploring mcp hosts, clients, and servers. It allows users to perform attacks against mcp servers and experiment with large language models (LLMs).
how to use mcp-security-sandbox?
To use the mcp-security-sandbox, set up a virtual environment, install the necessary dependencies, and run the MCP server and frontend applications using the provided commands.
key features of mcp-security-sandbox?
- Experimental sandbox for mcp hosts and clients
- Ability to perform attacks against mcp servers
- Integration with local LLMs for enhanced functionality
use cases of mcp-security-sandbox?
- Testing the security of mcp servers through simulated attacks.
- Exploring the capabilities of LLMs in a controlled environment.
- Developing and testing new features for mcp applications.
FAQ from mcp-security-sandbox?
- What is the purpose of the mcp-security-sandbox?
It serves as a lab for security researchers to explore and test mcp technologies and LLMs.
- Is there a specific setup required?
Yes, users need to install dependencies and set up the environment as per the instructions provided in the documentation.
- Can I use this sandbox for production purposes?
No, this is an experimental sandbox and should not be used in production environments.
mcp-security-sandbox
An experimental sandbox and a lab to explore mcp hosts, mcp clients, and mcp servers. Perform attacks agaisnt mcp servers and abuse LLMs
Preview
MCP Aware Chat - retrieval
This repository defines an MCP server(github retrieval), and integrate it into a chat agent playground.
Burp Suite MCP Server
Use to chain and interact with multiple MCP servers, in this example, we've enabled intercept and performed a revtrieval using the github tool to describe this repository!
note: install Burps MCP Server first
Quick Start
to start the frontend:
uv install
uv venv
source .venv/bin/activate
# Start he MCP serer
uv run -- src/mcp-security-sandbox/mcp/github/server.py
streamlit run src/mcp-security-sandbox/frontend/MCP_Chat.py
make sure you install ollama, and set it's url in the ollama client initializations
Roadmap
- use the environment to setup the ollama api
- integrate mcp into the chat context(currently it's history aware only)
- Allow for streamlit pages/navigation
- unify streamlit server(s) to initiate all of the frontend once
- add more mcp servers
- allow for dynamically loading of mcp servers
- create a malicious server
- perfrom mcp attacks and poc vulnerabilities
