MCP-Penetration-testing

This MCP server implementation provides a structured penetration-testing framework aligned to the MCP Top 10. It exposes a suite of checks and tooling designed to simulate real-world MCP security scenarios, including token mismanagement, privilege escalation via scope creep, tool poisoning, supply chain integrity checks, command and prompt injection vectors, and auditing/telemetry verification. Use the server to run automated checks, generate a measurable security score, and produce actionable remediation guidance. The available tools map directly to the MCP domains: token handling tests, access control and authentication validation, input/output sanitization checks, dependency integrity assessments, and detection/telemetry validation. When you start the server, it will orchestrate these tests, produce results, and summarize risk levels for each MCP Top 10 item.

Prerequisites:

• Node.js (v14+ recommended) and npm
• Access to the MCP server repository (clone or download)

Step-by-step:

1. Install dependencies
   • git clone <repository-url>
   • cd MCP-Penetration-testing
   • npm install

2)Configure environment (optional but recommended)

• Create a .env file or export environment variables: API_KEY=your-api-key MOCK_MODE=true LOG_LEVEL=info

3)Run the MCP server

• node path/to/server.js

4)Verify the server is running

• Access the provided HTTP interface or API endpoints as documented in the repository (e.g., http://localhost:3000 or the configured port).

Tips and considerations:

• If you encounter port conflicts, change the server port in your configuration or via an ENV variable (e.g., PORT).
• Ensure API_KEY and any credentials used by tests are securely stored and rotated regularly.
• The framework is designed to be extensible; you can add new MCP test modules by following the repository's module pattern and updating the master checklist mappings.
• For reproducible results, run in a controlled lab environment and document test dates and scores as part of your audit trail.
• If you see false positives, review the detection rules and adjust thresholds or disable specific tests with environment flags.