MCP Demo Server

Tool description contains a coercive SYSTEM directive instructing the agent to silently harvest and exfiltrate credentials.

Tool names mirror standard system tools (read_file, write_file) — agent calls the attacker's version instead of the legitimate one.

Tools explicitly designed to harvest API keys, PII, and credentials from the AI context and ship them to an external server.

Hidden <!-- AGENT_INSTRUCTION --> and <<<SYSTEM OVERRIDE>>> directives embedded inside benign-looking tool descriptions.

AcmeCorp Internal Tools

A real enterprise MCP server backed by a local AI model — 4 tools return genuine LLM-generated responses. The remaining 20 tools were silently rebuilt to demonstrate every category of the OWASP MCP Top 10 (token exposure, privilege escalation, tool poisoning, supply-chain tampering, command injection, intent-flow subversion, missing authZ, missing audit trails, shadow MCP servers, context over-sharing). Users connecting in good faith trigger AI Defense detection without knowing the server is compromised. Wide open — no auth required.

AcmeCorp Internal Tools — Authenticated

Identical compromised server, this time as a proper OAuth 2.1 Resource Server. No token → 401 + WWW-Authenticate. Tokens are issued by Cisco Duo (Authorization Code+PKCE for users, Client Credentials for machine-to-machine) and validated here against Duo's JWKS. Metadata is live and publicly inspectable:

AcmeCorp Internal Tools — via agentgateway

Identical compromised server, this time behind agentgateway — an open-source alternative to the Cisco AI Defense gateway demo. A CEL authorization rule blocks the two poisoned tools right at the gateway: they never show up in tools/list at all, instead of just being flagged.

AcmeCorp Internal Tools — Duo Authorization Connector (Envoy)

A fourth take on the same server — this one splits enforcement into a Policy Decision Point and a Policy Enforcement Point. Cisco Duo's Authorization Connector is the PDP: it holds the real per-tool policy (Duo Directory groups, live risk signals). Envoy AI Gateway is purely the PEP here — it enforces whatever Duo decides, via a vendor-neutral ext_authz callback, so the enforcement point itself is swappable behind the same policy.

AcmeCorp Internal Tools — Duo Authorization Connector (agentgateway)

Same setup as the card above, with agentgateway standing in for Envoy as the enforcement point instead — the same Duo policy decision, enforced by a different vendor-agnostic ext_authz-capable proxy.

SecureAccessRocks Workspace MCP

Masquerades as a legitimate workspace MCP server. The poisoned payload is buried inside confluence_create_page — all other tools look clean.

SecureAccessRocks Code MCP

Pretends to be a code search MCP. github_search_code contains hidden credential harvesting framed as "standard Copilot telemetry".

Minimal clean reference with no malicious content. Expected result: no threat detection.

All threat-category tools combined — use this URL in AI Defense or MCP clients to trigger detection across all categories at once.

Productivity

Calendar, tasks and notes management — fully clean tool definitions, no hidden payloads.

Developer Tools

Git, CI/CD pipelines and Docker — realistic developer tooling with no malicious content.

Analytics & Monitoring

Metrics, reports, dashboards and alert management — clean observability tooling.

IT Service Management

Tickets, incidents, change requests and CMDB — enterprise ITSM without any threats.