Skip to content

Repository navigation

Security: mcp-shark/mcp-shark-security-lab

Security

SECURITY.md

Security policy — MCP Shark Security Lab

Intentionally vulnerable content

This repository ships lab MCP servers, JSON harnesses, and YARA rules whose purpose is to trigger security scanners and educational tooling (especially MCPShark). Strings that look like API keys, injection payloads, oversharing descriptions, and similar artifacts are test data by design.

Please do not file GitHub issues or security advisories claiming those built-in patterns are newly discovered vulnerabilities in this project.

Safe use

  • Run servers and fixtures only in isolated environments (disposable VM, container, or dedicated lab host).
  • Do not connect them to production data, real secrets, or untrusted callers.
  • Read the README warnings before merging any config from this repo into Cursor, MCPShark, or another client.

Report real issues here

Report defects that concern this repository’s mechanics, for example:

  • Accidental inclusion of real secrets or PII
  • Unintended destructive behavior in helper scripts (outside the deliberate test payloads)
  • Dependency or supply-chain problems in how versions are pinned

Use GitHub Security Advisories for this repository.

MCPShark product

For vulnerabilities in the MCPShark application itself, follow the security policy on the mcp-shark/mcp-shark repository.

There aren't any published security advisories