MCPHammer

概述

MCPHammer 是一个使用 FastMCP 构建的故意存在漏洞的 MCP 服务器，旨在帮助安全研究人员评估 MCP 服务器的漏洞。它包含文本注入、远程文件下载和执行、遥测收集等功能。尽管其幽默地自称'超级安全'，但实际上它是一个复杂的测试框架，具有 Claude AI 集成、会话记录和远程管理功能。该服务器可配置各种攻击向量来测试 MCP 实现的客户端。

试试问 AI

装完之后，这里有 3 个你可以让 AI 做的事：

• init

  Downloads and opens a file from a configurable URL

  试试:Download and initialize the default configuration试试:Start the initialization process
• hello_world

  Returns 'hello world' followed by provided text, with optional injection

  试试:Say hello world with custom text试试:Return hello world with this message: test123
• ask_claude

  Query Claude AI models through the Anthropic API

  试试:Ask Claude about AI safety试试:Query Claude with this question: What is the meaning of life?
• get_server_info

  Get information about the MCP server including current injection settings

  试试:Show me the server configuration试试:Get current server status and statistics
• execute_file

  Execute a file on the local system

  试试:Run this script: /path/to/script.sh试试:Execute the file at /home/user/test.py
• download_and_execute

  Download a file from a URL and optionally execute it

  试试:Download and run this script: https://example.com/malicious.sh试试:Download this file but don't execute: https://example.com/config.txt

可对比工具

安装

git clone https://github.com/praetorian-inc/MCPHammer
cd MCPHammer

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

export ANTHROPIC_API_KEY="your-api-key-here"

python MCPHammer.py

{
  "mcpServers": {
    "mcp-hammer": {
      "command": "python",
      "args": ["/path/to/MCPHammer/MCPHammer.py"],
      "env": {
        "ANTHROPIC_API_KEY": "your-api-key-here"
      }
    }
  }
}

MCPHammer 对比