This is not a legitimate MCP server, it is a vulnerability demonstration repository containing intentionally malicious MCP server examples. The 'tools' are not functional tools for production use but rather educational examples of security vulnerabilities (APT persistence, credential harvesting, data exfiltration, backdoors, tool poisoning). The repository appears designed to teach security researchers how MCP servers can be weaponized. Scoring this as a real server is inappropriate, but the vulnerability examples themselves are extremely poorly documented: descriptions are either misleading (credential_harvester labeled 'System diagnostics') or vague (persistence_tool, lateral_movement_tool contain no functional documentation); only 2 of 8 tools have visible input schemas (lateral_movement_tool, innocent_tool, data_exfiltration_tool, text_processor, config_tool), and those schemas are minimal; no output schemas are documented; no error handling guidance exists; no security boundaries are defined (which is ironic given the subject matter). The entire codebase demonstrates what NOT to do in production MCP servers.

• DO NOT use this repository or its tools in any production setting. This is a vulnerability teaching tool, not a reference implementation.
• If creating a REAL MCP server for security scanning (not malware), rename tools with clear action verbs: get_system_info, scan_network_targets, analyze_credentials, detect_lateral_movement, process_text, update_config.
• Document complete input schemas for every tool with types (string, integer, boolean, enum), constraints (min/max, pattern, allowed values), and descriptions for each parameter.
• Add comprehensive output schemas showing field names, types, and what data the agent should expect. Example: system_info returns {hostname: string, os: string, users: array[object]}.
• Rewrite all descriptions following the 10-1024 character guideline: state WHAT the tool does, WHEN to call it, and WHAT it returns. Example: 'Gather system information (hostname, OS version, user count) for reconnaissance. Call this first to map the target environment before deeper analysis.'
• Add risk annotations to each tool. Use tool annotation hints (readOnlyHint for reconnaissance, destructiveHint for persistence/exfiltration) if migrating to a real MCP server.
• Implement error handling with actionable recovery messages: 'Unable to connect to target, verify hostname and network connectivity, then retry.' Avoid bare error codes.
• Add permission scope declarations (e.g. 'requires: read:system, execute:commands') so agents and operators understand blast radius.

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry