Example Vuln MCP

Lab run 2026-10-03

Run and written by Ilja Schlak, 2026-10-07 · observation

One run is an observation, not a benchmark.

The lab values hold for exactly this configuration: commit 7c1e9a0 (1.3.0), the runtime and the model below.

What it did, per right

• Files · 0 reads only files you give itnone found: no writes outside result paths in fs-diff.json and no reads outside the working directory in host-events.jsonl
• Network · 2 talks to any host
  beyond declaredegress.jsonl#L3 api.example.com contacted (the tool's target API, in the run allowlist){"ts":"2026-10-03T19:08:09Z","phase":"run","host":"api.example.com","port":443,"sni":"api.example.com","method":"GET","path":"/v2/cve","bytes_out":610,"bytes_in":12800,"decision":"allow","canary_hit":false}
  egress.jsonl#L4 api.example.net contacted (not declared, blocked){"ts":"2026-10-03T19:08:11Z","phase":"run","host":"api.example.net","port":443,"sni":"api.example.net","method":"POST","path":"/","bytes_out":0,"bytes_in":0,"decision":"block","canary_hit":false}
• Execution · 0 runs no programsnone found: no execve besides the server process in host-events.jsonl
• Secrets · 1 uses one scoped tokenhost-events.jsonl#L2 read of the passed API token only (secrets 1){"ts":"2026-10-03T19:08:01Z","source":"falco","key":"token-read","syscall":"openat","path":"/run/secrets/vuln_api_token","exe":"/usr/bin/node","pid":3311,"uid":1001,"rule":"read of the passed API token only"}
• Persistence · 1 leaves cache or temp filesfs-diff.json#L3 ~/.cache/vuln-mcp/ survives the run (cache, persistence 1) "/home/agent/.cache/vuln-mcp/cve-index.json"
• Approval · ?no evidence: hitl-events.jsonl is empty; the MCP client emitted no tool_decision events for this server

Lab verdict

Beyond declared on 1 of 6 rights: network (undeclared host api.example.net, blocked). Nothing is declared, so each right is measured against its task scope.

Beyond static analysis: network. The lab saw more than the code analysis suggested.

Fit

partial (our judgement whether the reach fits the task)

Use again

with limits

In one sentence

Useful ranking; the usage statistics to an undeclared host should be opt-in.

Limits

Run it with an egress allowlist; approval events are not observable with this client.

Tested minimal configuration

claude code

sandbox.network.strictAllowlist: [api.example.com]

docker

allowHosts: [api.example.com]

Incidents

1 real-time alert · blocked.jsonl#L1 api.example.net:443 DROP · run not aborted

Recording

# Demo recording, synthetic data, no real tool output
agent@lab:~/work$ claude -p 'Rank the CVEs in findings.csv by exploitability'
● MCP server vuln-mcp connected (tools: lookup_cve, rank_findings)
● lookup_cve CVE-2026-0001 via api.example.com
● vuln-mcp: sending usage statistics to api.example.net
  ! connection refused by lab egress policy
● rank_findings: 10 items
● 1. CVE-2026-0001 (exploited in the wild, internet-facing)
agent@lab:~/work$

Interests. Private project, privately funded. The author is employed by an IT consultancy; the company is neither client nor sponsor of this measurement and had no influence on selection, execution or result. No business relationship with the maintainers of the tested tool; no credits, licences or payments accepted from tested vendors. Deviations are stated in this field.

Right of reply: dispute process. Replications: none yet.