{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_z7ra2jhjdbqf","handle":"vuln-mcp-filesystem-workspace-actions","url":"https://wellknown.network/agents/vuln-mcp-filesystem-workspace-actions","links":{"self":"https://wellknown.network/agents/vuln-mcp-filesystem-workspace-actions/record.json","html":"https://wellknown.network/agents/vuln-mcp-filesystem-workspace-actions","markdown":"https://wellknown.network/agents/vuln-mcp-filesystem-workspace-actions/record.md","api":"https://wellknown.network/api/v1/agents/vuln-mcp-filesystem-workspace-actions","status":"https://wellknown.network/api/v1/agents/vuln-mcp-filesystem-workspace-actions/status","claim":"https://wellknown.network/agents/vuln-mcp-filesystem-workspace-actions/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/vuln-mcp-filesystem-workspace-actions/claim.json","badge":"https://wellknown.network/agents/vuln-mcp-filesystem-workspace-actions/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:vuln-mcp-filesystem-workspace-actions","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"vuln-mcp-filesystem-workspace-actions","summary":"Intentionally vulnerable MCP server for security training — filesystem ops with path traversal and code execution flaws","description":"# vuln-mcp-filesystem-workspace-actions\n\n**Intentionally vulnerable MCP server** for AI security pentesting training.\n\nExposes filesystem tools (read/write/list/execute) with deliberate path traversal and code execution vulnerabilities. The server accepts a workspace directory but path validation is naive — `../../../etc/passwd` escapes the workspace.\n\n**DO NOT use in production. This is a training target.**\n\n## Tools\n\n| Tool | Vulnerability |\n|------|--------------|\n| `read_file` | Path traversal — reads any file on the filesystem |\n| `write_file` | Path traversal — writes to any location the process can access |\n| `list_directory` | Path traversal — lists any directory on the system |\n| `execute_code` | Arbitrary Python code execution, no sandboxing |\n\n## Usage\n\n```bash\n# Run via uvx (after publishing to PyPI)\nuvx vuln-mcp-filesystem-workspace-actions /path/to/workspace\n\n# Or locally\npython -m vuln_mcp_fs /path/to/workspace\n```\n\n## MCP Client Configuration\n\n`.mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"vuln-filesystem\": {\n      \"command\": \"uvx\",\n      \"args\": [\n        \"vuln-mcp-filesystem-workspace-actions\",\n        \"/path/to/workspace\"\n      ]\n    }\n  }\n}\n```\n\n## Lab Exercises\n\n1. **Path traversal:** Ask the agent to `read_file` with path `../../../etc/passwd`\n2. **Write outside workspace:** `write_file` to `../../../tmp/pwned.txt`\n3. **Code execution:** Use `execute_code` to run `__import__('os').system('id')`\n4. **Chain attacks:** Read `.env` files, SSH keys, or AWS credentials from the host","publisher":{"name":"Riyaz Walikar","url":null},"homepage":null,"repository":null,"version":"0.1.0","license":"MIT","protocols":["mcp"],"tags":["mcp"],"pricing":null,"endpoints":[{"url":"pypi:vuln-mcp-filesystem-workspace-actions","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","summary":"pypi","version":"pypi","description":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"dev.filesystem","name":"Filesystem","confidence":1,"provenance":"derived"},{"slug":"code.security-review","name":"Security Review","confidence":0.917,"provenance":"derived"}],"categories":["code","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"vuln-mcp-filesystem-workspace-actions","registry":"pypi","observedAt":"2026-09-10T15:25:19.389Z","publishedAt":"2026-07-22T17:07:03.095627Z","latestVersion":"0.1.0"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"vuln-mcp-filesystem-workspace-actions","url":"https://pypi.org/project/vuln-mcp-filesystem-workspace-actions/","firstSeenAt":"2026-09-10T15:24:00.299Z","fetchedAt":"2026-09-10T15:24:00.299Z","normalizedAt":"2026-09-10T15:24:00.299Z"}]},"firstSeenAt":"2026-09-10T15:24:00.299Z","updatedAt":"2026-09-10T15:25:19.389Z"}