mcpgoat
A deliberately insecure MCP server for practicing penetration testing, featuring 26 challenges at three difficulty levels with flags to capture, covering vulnerabilities like RCE, SSRF, SQLi, and more.
- Score
- 57.2452 signals
- Evidence
- 7 stars · 1 fork
- Last commit
- as last read from GitHub; most reads are from 2 Sep 2026 or later
- Listed
Install
No one-command install. Set it up from its source.
Alternatives · MCPs
- bishopfox-otto-support20 stars63.429
- brokenmcp14 stars59.854
- mehulvyas911-eng-majestic-ai3 stars38.412
What it is
A deliberately insecure MCP server for practicing penetration testing, featuring 26 challenges at three difficulty levels with flags to capture, covering vulnerabilities like RCE, SSRF, SQLi, and more.
When to use it
A deliberately insecure MCP server for practicing penetration testing, featuring 26 challenges at three difficulty levels with flags to capture, covering vulnerabilities like RCE, SSRF, SQLi, and more.
How to install / invoke
See Glama for the install config.
Notes
Listed from the Glama MCP registry.