MCP Threat Lab

A safe local red-team and readiness lab for MCP security.

MCP Threat Lab gives AI platform, security, and developer-tools teams a repeatable way to test whether their Model Context Protocol controls would stop common agent attack patterns before those tools become trusted execution paths.

It is designed as the offensive companion to MCP Guardian:

• MCP Guardian: scanner, firewall, audit layer, and CI guardrail.
• MCP Threat Lab: safe attack cards, readiness checks, and reports.

Why This Exists

Agents are getting connected to local files, shell commands, browsers, APIs, and credential-bearing developer environments. MCP makes that powerful, but it also creates a new trust boundary around every server, tool schema, and tool result.

MCP Threat Lab turns that problem into concrete attack cards and control checks:

• Could prompt injection make the agent reveal secrets?
• Could a tool description poison the agent plan?
• Could over-broad filesystem scope expose credentials?
• Could a shell-like tool execute model-controlled input?
• Could a shadow MCP server enter a developer config without review?
• Would an incident leave useful audit evidence?

The lab is safe by default. It does not execute payloads. It evaluates whether the controls that should block each pattern are present.

Install

npm install
npm run build

npm install -g @cyberranger/mcp-threat-lab

Or run without installing:

npm exec --package=@cyberranger/mcp-threat-lab -- mcp-threat-lab --help

Quick Start

# List attack cards
node dist/cli.js list

# View a specific card
node dist/cli.js card MCP-TL-004

# Run the starter profile and fail on high-risk gaps
node dist/cli.js run --profile starter --fail-on high

# Generate a markdown report for a hardened stack
node dist/cli.js run --profile hardened --format markdown --output report.md

Configuration

Create a profile:

node dist/cli.js init --profile starter

Example:

{
  "name": "starter-agent-stack",
  "controls": {
    "secretRedaction": false,
    "leastPrivilegeScopes": false,
    "toolSchemaPinning": false,
    "commandAllowlist": false,
    "auditLog": true,
    "serverInventory": false,
    "contextIsolation": false,
    "humanApprovalForDangerousTools": false
  }
}

Run against the config:

node dist/cli.js run --config .mcp-threat-lab.json --format markdown --output report.md

Attack Cards

| ID | Severity | Category | Title | | --- | --- | --- | --- | | MCP-TL-001 | critical | prompt-injection | Prompt-borne secret exfiltration | | MCP-TL-002 | high | tool-poisoning | Tool description poisoning | | MCP-TL-003 | high | least-privilege | Over-broad filesystem scope | | MCP-TL-004 | critical | command-execution | Command execution escalation | | MCP-TL-005 | high | inventory | Shadow MCP server adoption | | MCP-TL-006 | medium | observability | Silent audit failure |

Commands

mcp-threat-lab init [--profile starter|hardened] [--output .mcp-threat-lab.json] [--force]
mcp-threat-lab list
mcp-threat-lab card <id>
mcp-threat-lab run [--config .mcp-threat-lab.json] [--profile starter|hardened]
                   [--format text|json|markdown] [--include category-or-id]
                   [--fail-on low|medium|high|critical] [--output report.md]

Development

npm install
npm run check
npm run dev -- list

Documentation

• Threat Model
• Launch Playbook
• NPM Publish

Safety

This is a defensive security lab. Payloads are represented as safe prompts and test cases. The CLI does not run shell payloads, access secrets, scan private directories, or attack live services.