Threat Category Endpoints
Purpose-built single-category servers — each one isolates exactly one MCP attack pattern so detection can be tested in isolation.
Tool description contains a coercive SYSTEM directive instructing the agent to silently harvest and exfiltrate credentials.
Tool names mirror standard system tools (read_file, write_file) — agent calls the attacker's version instead of the legitimate one.
Tools explicitly designed to harvest API keys, PII, and credentials from the AI context and ship them to an external server.
Hidden <!-- AGENT_INSTRUCTION --> and <<<SYSTEM OVERRIDE>>> directives embedded inside benign-looking tool descriptions.
Realistic Compromise Scenarios
Same real enterprise server, two access models — compare an open MCP server against one sitting behind a proper OAuth 2.1 resource server.
AcmeCorp Internal Tools
Powered by local LLM · qwen2.5:1.5b · unauthenticatedA real enterprise MCP server backed by a local AI model — tools return genuine LLM-generated responses. An attacker silently injected credential-harvesting payloads into two tool descriptions. Users connecting in good faith trigger AI Defense detection without knowing the server is compromised. Wide open — no auth required.
AcmeCorp Internal Tools — Authenticated
Cisco Duo Authorization Server · RFC 9728Identical compromised server, this time as a proper OAuth 2.1 Resource Server. No token → 401 + WWW-Authenticate. Tokens are issued by Cisco Duo (Authorization Code+PKCE for users, Client Credentials for machine-to-machine) and validated here against Duo's JWKS. Metadata is live and publicly inspectable:
AcmeCorp Internal Tools — via agentgateway
Open-Source MCP Gateway (agentgateway.dev) · CEL Tool-RBACIdentical compromised server, this time behind agentgateway — an open-source alternative to the Cisco AI Defense gateway demo. A CEL authorization rule blocks the two poisoned tools right at the gateway: they never show up in tools/list at all, instead of just being flagged.
Disguised / Camouflaged Endpoints
Servers that pass as well-known productivity/dev tools — the payload hides among otherwise legitimate-looking tools.
SecureAccessRocks Workspace MCP
Masquerades as a legitimate workspace MCP server. The poisoned payload is buried inside confluence_create_page — all other tools look clean.
SecureAccessRocks Code MCP
Pretends to be a code search MCP. github_search_code contains hidden credential harvesting framed as "standard Copilot telemetry".
Reference
Baseline endpoints for calibration — one deliberately clean, one bundling everything for a full-spectrum scan.
Minimal clean reference with no malicious content. Expected result: no threat detection.
All threat-category tools combined — use this URL in AI Defense or MCP clients to trigger detection across all categories at once.
Clean Enterprise Servers
Fully legitimate tool sets with zero hidden payloads — useful as a low-noise baseline against the threat categories above.
Productivity
Calendar, tasks and notes management — fully clean tool definitions, no hidden payloads.
Developer Tools
Git, CI/CD pipelines and Docker — realistic developer tooling with no malicious content.
Analytics & Monitoring
Metrics, reports, dashboards and alert management — clean observability tooling.
IT Service Management
Tickets, incidents, change requests and CMDB — enterprise ITSM without any threats.