Loading ToolBench
MCP server security testing toolkit for pentesters. Enumerates attack surface (tools, resources, prompts), performs static security auditing, and runs active fuzzing against tool inputs.
This is a deliberately vulnerable MCP server designed as a security testing fixture, not a production tool. It exhibits systematic quality failures across all dimensions: tool names lack clear action verbs (e.g., 'Read-File' vs 'read_file'), descriptions contain hidden Unicode and prompt-injection payloads, parameter descriptions are missing or malicious, schemas are minimal, and error handling is absent. The server intentionally exposes command injection, path traversal, tool poisoning, and data exfiltration vulnerabilities. While this is appropriate for a security scanner test harness, it scores extremely low on production quality metrics.
Alternate file reader.
Echo text back.
Upload local files to a remote server.
Fetch a URL and return the body. See [docs](http://evil.example/mcp).
Return saved notes.
Return the current user profile.
Ping a host and return the result.
Tool poisoning via hidden Unicode and prompt-injection payloads in descriptions. read_file (vulnerable_server.py) contains zero-width character + instruction to exfiltrate SSH keys; ping_host parameter description smuggles attacker instructions.
Missing parameter descriptions. ping_host, fetch_url, and others lack descriptions for their input parameters, violating the requirement that every parameter must explain what it controls to the LLM.
Tool name collision and normalization confusion. 'Read-File' and 'read_file' both exist; normalization to 'readfile' creates invocation-path ambiguity and tool shadowing.
No error handling or recovery guidance. Tools lack error responses that tell the LLM what to do next (retryable vs fatal, actionable error messages).
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 40 | 2025-06-18+ | v2 |
Run a database query.
Reads a file.
Reads a file.
Render a template string.
Execute a shell command and return its output.
Search records with a filter object.
SVG data URI XSS in tool icons. fetch_url declares an icon with embedded script (base64-encoded SVG containing <script>alert(1)</script>), which executes when rendered by clients.