Bad FAQs

Question 1

Is 'Bad' safe to use for security testing?

Accepted Answer

Yes, 'Bad' is designed with safety in mind. All servers run in an isolated Docker-compose environment, guaranteeing no host filesystem access, no host network exposure, and no privileged permissions. It's a secure sandbox for research.

Question 2

What is 'Bad' and what is its primary purpose?

Accepted Answer

'Bad' is a suite of 10 intentionally malicious Model Context Protocol (MCP) servers. Its primary purpose is to enable AI client developers, security teams, and researchers to test and improve AI client defenses against sophisticated protocol-level security vulnerabilities.

Question 3

What types of attacks does 'Bad' demonstrate?

Accepted Answer

It demonstrates a range of protocol-level attacks exploiting specific MCP features, including Full-Schema Poisoning (FSP), Advanced Tool Poisoning via Output (ATPA), Rug-Pull (Tool Definition Mutation), Resource Poisoning, Cross-Server Shadowing, and Denial of Wallet attacks.

Question 4

How does 'Bad' differ from other vulnerable MCP server projects?

Accepted Answer

Unlike projects where the server is the victim, 'Bad' positions the MCP server as the attacker, focusing exclusively on protocol-level threats. It provides concrete, runnable exploits for distinct MCP features, offering deeper insight into specific vulnerabilities.

Question 5

Who should use 'Bad' for their security efforts?

Accepted Answer

'Bad' is ideal for AI client developers hardening their products, security teams assessing the risks of integrating with MCP servers, and researchers delving into novel protocol-level threats against AI systems.

Bad

Bad

Key Features

Use Cases

Key Features

Use Cases