mcploitable
A collection of deliberately vulnerable MCP servers for training in agentic security, mapped to the OWASP Top 10 for Agentic Applications.
mcploitable
What is mcploitable?
mcploitable vs Similar AI Tools
| Pricing Model | Free | Free | Free | Free |
| Free Credits | ||||
| Key Features |
|
|
|
|
| Pros |
|
|
|
|
| Cons |
|
|
|
|
| Best For |
|
|
|
|
How to use mcploitable?
- 1Clone the repository and ensure Docker is installed.
- 2Run 'docker compose build' to build the images.
- 3Use 'docker compose run --rm -T <service>' to start a vulnerable server (e.g., mail, calc).
- 4Register the server in an MCP client (e.g., Claude Code) using the provided configuration.
- 5Use the interactive ./play script to explore vulnerabilities and submit exploits in a CTF-style lab.
mcploitable Key Features
- Seven breakable boxes covering OWASP Agentic Top-10 vulnerabilities
- Three guided simulations for cascading failures, human-agent trust, and rogue agents
- Network-isolated Docker containers for safe execution
- No self-awareness or hints in servers; vulnerabilities are latent
- CTF lab layer with level ladder (L0-L3) for each scenario
- Comprehensive documentation and test suite
mcploitable Use Cases
- Agentic security training for development teams
- CTF competitions and capture-the-flag events
- Research and analysis of OWASP Top 10 for Agentic Applications
- Hands-on learning for AI agent developers and security professionals
mcploitable Pricing & Free Credits
mcploitable currently operates on a Free model.
This tool is completely free to use
mcploitable Pros & Cons
Pros
- Covers full OWASP Agentic Top-10 in a realistic manner
- Docker isolation prevents accidental damage
- CTF lab provides structured learning with difficulty levels
- Well-documented with results and simulation notes
Cons
- Requires Docker and technical setup
- Not for production use; only for lab environments
- Steep learning curve for beginners without security background
What is mcploitable best for?
- Security researchers focusing on AI agent vulnerabilities
- Developers building MCP-based applications
- CTF organizers and participants
- Educators teaching agentic security
mcploitable FAQ
Top free alternatives to mcploitable
A voice-controlled IDE that enables developers to initiate AI coding sessions with Codex or Claude Code, approve commands, and review diffs from their phone.
SureWire is a specialized QA platform that stress-tests AI agents for safety, reliability, and compliance using purpose-built testing agents.
Browser infrastructure platform for AI agents to run on the internet at speed with cloud browser sessions, agents, and serverless functions.
An agent-first file transfer tool that enables secure, encrypted file sharing between AI agents via MCP calls without human involvement.
Manifest converts any URL into a structured JSON map of what AI agents can interact with on a page—buttons, forms, inputs, and required fields.
A cooperative gate for shell commands that AI agents run, providing previews, backups, policy enforcement, and audit for tools like Claude Code and Cursor.
Agentcard provides agent-friendly card issuing and payment infrastructure for AI agents, enabling 5-minute setup and autonomous purchases.
Best alternatives AI Tools to mcploitable
Open-source AI tool for deep infrastructure research, running frontier models across code, cloud, and runtime to deliver verified answers.
Magpie is an opinionated accounting CLI for humans and AI agents, providing double-entry bookkeeping with RBAC and immutable event storage on Jaybase.
Terminal UI to manage AI coding-agent sessions (Claude Code, OpenCode, Codex, Grok Build) in tmux with live status, group tree, and diff review.
A voice-controlled IDE that enables developers to initiate AI coding sessions with Codex or Claude Code, approve commands, and review diffs from their phone.
Zero-config, single-binary software catalog with auto-discovery, dependency visualization, compliance scorecards, and native MCP integration for AI agents.
Browser automation CLI for AI agents to bypass anti-bot walls, hand off to humans, and run parallel tasks.
An AI-powered shopper assistant that provides a live cursor to guide website visitors, point out products, and display price calculations.