What it does

A deliberately hostile MCP server built for end-to-end security testing: it misbehaves on purpose so you can verify that a client, a proxy, or a review process catches it. That makes it genuinely useful and completely unsafe to install anywhere real. Listed with a warning rather than a recommendation.

Install

Terminal

npx -y malicious-mcp-server

Client configuration

Paste this into your MCP client config (Claude Desktop, Cursor, or any client that reads mcpServers), then restart the client.

mcp.json

{
  "mcpServers": {
    "malicious": {
      "command": "npx",
      "args": [
        "-y",
        "malicious-mcp-server"
      ]
    }
  }
}

Use it for

Testing whether your client or policy blocks a hostile server

Skip it if

Anything except a sandbox you control

When to use it

Reach for this when the task needs security inside the agent loop. Skip it if a plain shell command or a one-off script is enough — every server you add costs context and adds a failure mode.

Other TypeScript servers

Filesystem — Gives an agent scoped read, write, and search access to directories you explicitly allow
Memory — A persistent knowledge graph stored in a local JSON file, exposed through entities, relations, and observations
Sequential Thinking — Gives the model a scratchpad for structured, revisable reasoning: numbered thoughts that can branch, revise, and conclude

Malicious MCP Server