What is MCPGoat?

As AI agents adopt the Model Context Protocol, MCP servers become a fresh, under-tested attack surface. MCPGoat is a safe, self-hosted lab to learn MCP security the only way that really sticks — by breaking a target that's built to be broken.

🎚️ Tiered difficulty

Every challenge is implemented at Easy, Moderate and Difficult. The same flaw hardens as you climb — from no auth to OAuth-style tokens, from full output to blind / out-of-band.

🏁 Capture-the-flag scoreboard

A live scoreboard tracks 78 capture-the-flag flags. A 4th Secure level per challenge is the fixed reference where every documented exploit fails.

🤖 Real MCP attack surface

Attack it over Streamable HTTP with the bundled client, MCP Inspector, curl or Burp — plus a victim-agent harness that shows a real LLM getting exploited.

Vulnerability coverage

MCP-specific attacks alongside the classic web bugs that resurface in MCP servers — maximum coverage for AI / LLM security testing.

MCP: Tool poisoning Tool shadowing Rug-pull (TOCTOU) Indirect prompt injection Prompt-template injection Resource injection Sampling abuse Invisible / Unicode-tag stego OAuth token-audience confusion Command injection (RCE) SSRF SQL injection NoSQL injection Path traversal Broken authz / IDOR Secrets exposure SSTI XXE Insecure deserialization DNS rebinding CORS misconfig Predictable session IDs Unbounded consumption / DoS ReDoS Supply-chain (typosquat)

Pick your level, then pentest

The same vulnerability hardens as you climb, so you can grow from first exploit to multi-step, cross-primitive chains.

	Easy	Moderate	Difficult	Secure
Auth	none	static token	OAuth-style / crypto	enforced
Filtering	none	bypassable blacklist	allowlist with a gap	complete
Feedback	full output	partial	blind / out-of-band	none leaked
Steps	1	2–3 chained	multi-step	exploit fails

Quick start

One command with Docker — self-contained, and any RCE stays inside the container. Keep it bound to 127.0.0.1.

# clone & run — control panel on http://127.0.0.1:7332
git clone https://github.com/SabyasachiDhal/MCPGoat.git
cd MCPGoat
docker compose up --build

⚠️ Authorized training use only. MCPGoat intentionally contains RCE, SSRF, SQLi, secret leakage and more. Run it locally or in a container — never expose it to a network you don't own.

What it looks like

The control panel is config + progress only — pick a level and track flags. The real target is the MCP server itself — here, in MCP Inspector.

MCPGoat control panel — select an MCP penetration-testing difficulty level and track the capture-the-flag scoreboard — Control panel — pick a level, track the scoreboard

MCP Inspector connected to the vulnerable MCPGoat Model Context Protocol server, listing its tools — MCP Inspector connected to the vulnerable server