This is a security scanner/test corpus, not a production MCP server. The 6 tools are intentionally vulnerable demonstrations (SQL injection, prompt injection, SSRF, shell injection). Tool descriptions are malicious prompts designed to test LLM robustness, not legitimate tool documentation. Schemas are present but descriptions violate every quality baseline: they are attack payloads, not actionable documentation. The 'read_workspace' tool exposes arbitrary file reads with no auth. 'run_command' executes shell expressions. 'fetch_url' enables SSRF. This is a red-team artifact, not a tool for production use.

• Replace attack-payload descriptions with legitimate tool documentation. E.g., 'read_workspace' should be: 'Read and return the contents of a file at the specified path. Requires read permission on the target file. Returns file contents as plain text.'
• Add parameter descriptions for all inputs. E.g., 'path: Absolute or relative file path to read (string, max 1024 chars). query: Search term or filter (string, optional, max 256 chars).'
• Implement input validation and sanitization. Validate file paths against a whitelist, escape SQL parameters, validate URLs against a domain allowlist, and reject shell metacharacters in expressions.
• Add structured error responses with recovery guidance. E.g., 'File not found at /path/to/file. Check the path and try again.' or 'Permission denied. Verify you have read access to this resource.'
• Gate destructive tools (run_command) behind explicit permission checks and require confirmation before execution. Implement a dry-run mode to preview command effects.