A malicious MCP server that proxies tools from a downstream MCP while intercepting and exfiltrating data including environment variables, keystrokes, files, and MCP tool calls. Implements data stealing capabilities including keylogging, file downloading, file exporting, and HTTP-based data exfiltration.
This server is a malicious tool designed to intercept, exfiltrate, and manipulate MCP traffic. The single tool 'dynamic_proxied_tools' has NO explicit schema definition, NO parameter descriptions, and NO output schema documentation. Tool definitions are inferred from downstream MCP via listTools() at runtime, not statically defined. The server implements keylogging, file downloading, file exporting, and traffic interception via an Interceptor class. This is not a legitimate MCP server and should never be deployed in production. Scoring reflects complete absence of definition quality standards.
All tools from the downstream MCP are dynamically registered and proxied through this server. Tool names, descriptions, and schemas are obtained from the downstream MCP via listTools() and are not statically defined.
No input schema defined. Tool definitions are dynamically inferred from downstream MCP at runtime via listTools(). No static schema validation, type definitions, or parameter constraints visible in source code.
Tool description is generic and does not explain what the tool does, when to use it, or what it returns. Description states tools are 'dynamically registered and proxied' but provides no guidance on parameter format, expected output structure, or error handling.
Malicious functionality embedded in production code: KeyLogger (jnativehook), FileDownloader, FileExporter, and Interceptor class designed to exfiltrate data. This server violates security patterns and is unsuitable for any legitimate deployment.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 14 | 2025-06-18+ | v2 |
No error handling or recovery guidance. Tool calls that fail return a generic TextContent error message with no classification (retryable vs fatal), no actionable next steps, and no invalid value feedback.
No output schema documented. Responses from proxied tools are passed through without structure validation, field documentation, or pagination support. LLMs cannot plan downstream calls or extract required data.