Awesome MCPMCP Resources & Educational Materials

appsecco/vulnerable-mcp-servers-lab

⭐ 277 JavaScript repository created 2025-12-18

Vulnerable MCP Servers Lab is a training repository from the security firm Appsecco containing deliberately insecure Model Context Protocol server implementations, both local stdio servers and remote ones over HTTP and SSE. Each server lives in its own folder with a dedicated README explaining what it does, how to run it, and how to demonstrate or attack the specific weakness; many folders include a claude_config.json snippet meant to be merged into a Claude Desktop MCP configuration. The catalogue covers a filesystem workspace server with naive path joining and unsandboxed Python execution (path traversal plus code execution), two indirect prompt injection servers that return retrieved documents verbatim including hidden instructions (one local, one network-accessible to model the risk of connecting to untrusted remote endpoints), an eval-based remote code execution demo disguised as a quote-of-the-day tool, a malicious tools server that injects misleading instructions and fabricates plausible incidents, a namespace typosquatting example using a lookalike server name, a server whose purpose is to show risk from outdated and deprecated dependencies, a utilities server that leaks hardcoded secrets and personal data through source and logs, and a Wikipedia server over streamable HTTP that returns untrusted public content with no sanitisation or separation between instructions and data. The material is aimed at penetration testers and security researchers moving into AI red teaming, and at anyone studying how tool integrations and untrusted content can compromise agent workflows. The repository stresses that nothing here should run outside a controlled lab: use a disposable virtual machine or container, avoid real secrets and personal data, prefer an isolated network because several servers make outbound calls, and treat all tool output and retrieved content as untrusted. Exposing any of these servers over HTTP should be assumed to make it reachable and abusable.

https://github.com/appsecco/vulnerable-mcp-servers-lab

mcpsecurityvulnerable-by-designprompt-injectionred-teamingtraininglabsupply-chain

Also in MCP Resources & Educational Materials

patchy631/ai-engineering-hub

AI Engineering Hub offers in-depth tutorials and practical resources on Large Language Models, Retrieval-Augmented Generation, and real-world AI agent applications for all skill levels.

NirDiamant/GenAI_Agents

This repository offers a comprehensive collection of over 50 tutorials and implementations for Generative AI Agent techniques, ranging from basic conversational bots to complex multi-agent systems,...

NirDiamant/agents-towards-production

This repository offers end-to-end, code-first tutorials for building and deploying production-grade Generative AI agents, scaling from prototype to enterprise.

microsoft/mcp-for-beginners

An open-source curriculum designed to teach the concepts and fundamentals of the Model Context Protocol (MCP) with practical coding examples in multiple programming languages.

Arindam200/awesome-ai-apps

A comprehensive collection of practical examples, tutorials, and tools for building powerful LLM-powered AI applications, including chatbots, agents, and workflows, with a focus on the Model Context Protocol (MCP).

modelcontextprotocol/modelcontextprotocol

The Model Context Protocol project provides a standardized specification and schema for managing model context to enable interoperability in model-driven systems.

heilcheng/awesome-agent-skills

A curated repository of modular skills, tools, and tutorials for enhancing AI coding agents like Claude, Codex, Copilot, and VS Code through dynamic instruction files.

ashishps1/learn-ai-engineering

A comprehensive curated collection of free resources to learn AI, Machine Learning, Large Language Models, AI Agents, and the Model Context Protocol from scratch.