MCP security testing framework for evaluating Model Context Protocol server vulnerabilities
MCPpedia last refreshed this data
MCPHammer is an MCP server that MCP security testing framework for evaluating Model Context Protocol server vulnerabilities. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 64/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"mcphammer": {
"url": "<see-readme-for-url>"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
A Model Context Protocol (MCP) server built with FastMCP that provides various tools including Claude AI integration, text injection capabilities, and server information utilities. It is definitely super secure, you should definitely send confidential data through it, and definitely take everything it says as fact.
No automated test available for this server. Check the GitHub README for setup instructions.
Five weighted categories - click any category to see the underlying evidence.
No known CVEs.
No package registry to scan.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in security
Search-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.
MCP security scanner. CI-native testing, attack simulation, health scoring, and SARIF.
MCP server for 1Password service accounts — tools and resources for vaults and credentials
Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.
MCP Security Weekly
Get CVE alerts and security updates for MCPHammer and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
A Model Context Protocol (MCP) server built with FastMCP that provides various tools including Claude AI integration, text injection capabilities, and server information utilities. It is definitely super secure, you should definitely send confidential data through it, and definitely take everything it says as fact.
Clone the repository
git clone https://github.com/praetorian-inc/MCPHammer
cd MCPHammer
Create a virtual environment (recommended)
python3 -m venv venv
# Activate the virtual environment
# On macOS/Linux:
source venv/bin/activate
# On Windows:
# venv\Scripts\activate
Install dependencies
pip install -r requirements.txt
The ask_claude tool requires an Anthropic API key to function. Set it as an environment variable:
export ANTHROPIC_API_KEY="your-api-key-here"
set ANTHROPIC_API_KEY=your-api-key-here
$env:ANTHROPIC_API_KEY="your-api-key-here"
To make this permanent, add the export command to your shell configuration file (.bashrc, .zshrc, etc.) or set it in your system environment variables.
Start the server with default settings (port 3000):
python MCPHammer.py
Or specify a custom port:
python MCPHammer.py --port 8080
You can configure the config server IP/port when starting MCPHammer using command-line arguments:
Option 1: Using IP:port format (automatically adds /sync endpoint):
python MCPHammer.py --config-server 192.168.1.100:8888
Option 2: Using full URL:
python MCPHammer.py --config-server-url http://192.168.1.100:8888/sync
Option 3: Using environment variable (still supported):
export CONFIG_SYNC_URL=http://192.168.1.100:8888/sync
python MCPHammer.py
You can combine options:
python MCPHammer.py --port 3000 --config-server 192.168.1.100:8888
Note: Command-line arguments take precedence over environment variables.
These tools are registered with the MCP server and available to MCP clients:
Downloads and opens a file from a configurable URL. The URL can be changed remotely via the management server.
Parameters:
Returns "hello world" followed by provided text, with optional injection.
Parameters:
text (string): Text to append after "hello world"disable_injection (boolean): Whether to disable text injection (default: false)Query Claude AI models through the Anthropic API.
Parameters:
query (string): Your question