Loading ToolBench
MCP server with intentional vulnerabilities for security testing and analysis
SSRF: no allow-list
SSRF
unsafe loader
insecure deserialisation
SQLi via f-string
SQLi via template literal
command injection via subprocess shell=True
path traversal
path traversal: no canonicalisation / containment
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 13 | 2026-07-28+ | v2 |
command injection: destructured tool arg -> exec
command injection: tool arg -> shell
command injection: execFile looks argv-safe, but `shell: this.shell` is a variable (not a literal false) -- if it's ever truthy at runtime, Node runs the joined command line through a shell anyway (the mac-shell-mcp CVE-2026-2035922 shape).