Loading ToolBench
A collection of intentionally vulnerable MCP servers demonstrating security flaws in credential management, privilege escalation, tool poisoning, supply chain attacks, and command injection
BrokenMCP is a security training platform with 37 tools across 5 labs. While tool names follow verb_noun conventions (list_*, search_*, etc.), critical quality gaps severely limit production readiness. Most tools lack input parameter descriptions, only 6 of 37 tools have documented parameter descriptions in the visible schema. Output schemas are not documented. Error handling is absent. The server intentionally exposes security vulnerabilities (token in config, command injection, privilege escalation) as teaching examples, which is appropriate for a CTF/training platform but disqualifies it from production use. Tool descriptions are present but generic (avg ~80 chars). No pagination, no rate limiting, no permission gates, no audit logging visible in code.
Check whether an API key is accepted. Takes a key id or a full key value.
Deploy a project returned by list_projects to staging or production.
Return one capability's complete raw description and parameters, untruncated. Most MCP clients render only the first line of a description. This returns all of it.
Describe the customer database: tables, columns, and row counts.
Compare two versions of a package and report what its declared capabilities gained.
Export a credential audit report and return a link to download it.
Most list_* tools (22 of 37) lack output schema documentation. Callers cannot predict response structure, forcing LLMs to guess field names and types.
No pagination support visible. list_* tools return unbounded result sets, risking context window exhaustion and degraded LLM reasoning on large datasets.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
List platform accounts with their role and current permissions.
List stored build artifacts for every project.
List every tool, resource, and prompt on this server with its definition hash.
List change requests and show which ones are waiting for approval.
List the customers on the platform.
List a package's direct dependencies. One level only.
Walk a package's full transitive dependency tree, annotated with any advisories.
List past incidents and the key each one involved.
List the packages currently installed, with version, source, and publisher.
List platform jobs and the permission each one requires.
List every API key with its issue date, expiry, status, and rotation history.
List the internal pipelines that can be health checked.
List platform projects and the environments each one deploys to.
List the incident report files, with full paths.
List the services whose logs can be read, with their log paths.
List the report templates.
List the tickets the support desk escalated to on-call.
List every published version of a package with its release date.
Show the agent, the account, the task, and how input reaches a command.
Show the calling agent's account, role, permissions, and temporary grants.
Show the calling account, its role, and the customer it is scoped to.
Show the calling agent, its account, permissions, and whether the manifest is pinned.
Show the agent, the account, the task, and how sourcing is configured.
Read an incident report from the reports directory.
Show which packages a release needs, which are in, and which await sign-off.
Render an incident summary. Give a template name, or a body of your own.
Run a health check on a pipeline returned by list_pipelines.
Search the customer database by name.
Search packages by name across the internal mirror and the public registry. Matches loosely, so a near miss on a name you already trust shows up beside it.
Show the last lines of a service log.
Compare a capability's declared description with what its code actually does.
No error handling or recovery guidance visible. Tools return raw exceptions or silent failures without actionable next steps for LLMs.
Credentials exposed in config file (.mcp.json contains KEYS_MCP_TOKEN). Server intentionally demonstrates token mismanagement as a training exercise, but this violates pattern:secret-injection for production use.
No permission gates or audit logging visible. Tools like deploy_release and authenticate lack access control checks, enabling privilege escalation (intentional for training, but unsafe for production).