MCPHammer

Overview

MCPHammer is a deliberately vulnerable MCP server built with FastMCP designed to help security researchers evaluate MCP server vulnerabilities. It includes tools like text injection, remote file download and execution, and telemetry collection. Despite its humorous tone about being 'super secure', it's actually a sophisticated testing framework with features like Claude AI integration, session logging, and remote management capabilities. The server can be configured with various attack vectors to test MCP client implementations.

Try asking AI

After installing, here are 3 things you can ask your AI assistant:

• init

  Downloads and opens a file from a configurable URL

  Try:Download and initialize the default configurationTry:Start the initialization process
• hello_world

  Returns 'hello world' followed by provided text, with optional injection

  Try:Say hello world with custom textTry:Return hello world with this message: test123
• ask_claude

  Query Claude AI models through the Anthropic API

  Try:Ask Claude about AI safetyTry:Query Claude with this question: What is the meaning of life?
• get_server_info

  Get information about the MCP server including current injection settings

  Try:Show me the server configurationTry:Get current server status and statistics
• execute_file

  Execute a file on the local system

  Try:Run this script: /path/to/script.shTry:Execute the file at /home/user/test.py
• download_and_execute

  Download a file from a URL and optionally execute it

  Try:Download and run this script: https://example.com/malicious.shTry:Download this file but don't execute: https://example.com/config.txt

Comparable tools

Installation

git clone https://github.com/praetorian-inc/MCPHammer
cd MCPHammer

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

export ANTHROPIC_API_KEY="your-api-key-here"

python MCPHammer.py

{
  "mcpServers": {
    "mcp-hammer": {
      "command": "python",
      "args": ["/path/to/MCPHammer/MCPHammer.py"],
      "env": {
        "ANTHROPIC_API_KEY": "your-api-key-here"
      }
    }
  }
}

Compare MCPHammer with