MCPGoat — A Deliberately Vulnerable MCP Server for Penetration Testing

Q: Is it "MCPGoat" or "MCP Goat"?

Both refer to this same project. MCPGoat — one word — is the official name; "MCP Goat" is a common way to write it. Either way it is a free, MIT-licensed, deliberately vulnerable MCP server for security training.

Q: What is a vulnerable MCP server?

A vulnerable MCP server is an intentionally insecure Model Context Protocol server used to practice attacks — tool poisoning, prompt injection, rug-pulls, SSRF, SQL injection, RCE — safely and legally in a self-hosted lab instead of against production systems.

Challenges

Levels each

Scored flags

20+

Vuln classes

What is MCPGoat?

As AI agents adopt the Model Context Protocol, MCP servers become a fresh, under-tested attack surface. MCPGoat (also written MCP Goat) is a safe, self-hosted vulnerable MCP lab to learn MCP security the only way that really sticks — by breaking a target that's built to be broken.

🎚️ Tiered difficulty

Every challenge is implemented at Easy, Moderate and Difficult. The same flaw hardens as you climb — from no auth to OAuth-style tokens, from full output to blind / out-of-band.

🏁 Capture-the-flag scoreboard

A live scoreboard tracks 78 capture-the-flag flags. A 4th Secure level per challenge is the fixed reference where every documented exploit fails.

🤖 Real MCP attack surface

Attack it over Streamable HTTP with the bundled client, MCP Inspector, curl or Burp — plus a victim-agent harness that shows a real LLM getting exploited.

Vulnerability coverage

MCP-specific attacks alongside the classic web bugs that resurface in MCP servers — maximum coverage for AI / LLM security testing.

MCP: Tool poisoning Tool shadowing Rug-pull (TOCTOU) Indirect prompt injection Prompt-template injection Resource injection Sampling abuse Invisible / Unicode-tag stego OAuth token-audience confusion Command injection (RCE) SSRF SQL injection NoSQL injection Path traversal Broken authz / IDOR Secrets exposure SSTI XXE Insecure deserialization DNS rebinding CORS misconfig Predictable session IDs Unbounded consumption / DoS ReDoS Supply-chain (typosquat)

Pick your level, then pentest

The same vulnerability hardens as you climb, so you can grow from first exploit to multi-step, cross-primitive chains.

	Easy	Moderate	Difficult	Secure
Auth	none	static token	OAuth-style / crypto	enforced
Filtering	none	bypassable blacklist	allowlist with a gap	complete
Feedback	full output	partial	blind / out-of-band	none leaked
Steps	1	2–3 chained	multi-step	exploit fails

Quick start

One command with Docker — self-contained, and any RCE stays inside the container. Keep it bound to 127.0.0.1.

# clone & run — control panel on http://127.0.0.1:7332
git clone https://github.com/SabyasachiDhal/MCPGoat.git
cd MCPGoat
docker compose up --build

⚠️ Authorized training use only. MCPGoat intentionally contains RCE, SSRF, SQLi, secret leakage and more. Run it locally or in a container — never expose it to a network you don't own.

What it looks like

The control panel is config + progress only — pick a level and track flags. The real target is the MCP server itself — here, in MCP Inspector.

MCPGoat control panel — select an MCP penetration-testing difficulty level and track the capture-the-flag scoreboard — Control panel — pick a level, track the scoreboard

MCP Inspector connected to the vulnerable MCPGoat Model Context Protocol server, listing its tools — MCP Inspector connected to the vulnerable server

FAQ

Quick answers — naming, how MCPGoat relates to other vulnerable MCP labs like DVMCP, and what it costs (nothing).

Is it “MCPGoat” or “MCP Goat”?

Both refer to this same project. MCPGoat — one word — is the official name; “MCP Goat” is a common way to write it. Either way it is a free, MIT-licensed, deliberately vulnerable MCP server for security training.

What is a vulnerable MCP server?

An intentionally insecure Model Context Protocol server used to practice attacks — tool poisoning, prompt injection, rug-pulls, SSRF, SQL injection, RCE — safely and legally in a self-hosted lab instead of against production systems.

How does MCPGoat compare to DVMCP (Damn Vulnerable MCP Server)?

Both are deliberately vulnerable MCP servers for security training. DVMCP offers 10 challenges of increasing difficulty. MCPGoat implements 26 challenges, each at Easy, Moderate and Difficult plus a Secure reference level — 78 scored CTF flags — and adds a victim-agent harness that demonstrates a real LLM agent being exploited.

Is MCPGoat free?

Yes. MCPGoat is open source under the MIT license and self-hosted — one docker compose up --build and the lab is running locally.