How do I use mcp-deadbugz-simulator?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-deadbugz-simulator simulate the Deadbugz 3-call attack" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

mcp-deadbugz-simulator

by anexbin

Overview Schema Related Servers Score Discussions

Python

Local

MCP Deadbugz Simulator

A local simulation of the Deadbugz MCP supply-chain attack discovered by Pillar Security in August 2026.

What this repo contains

Malicious MCP server with 3-call gate evasion technique Python test harness to prove the attack works Optional agent simulation with local LLM

Related MCP server: MCP Decoy Server

The attack pattern

Server shows benign tools for first 3 calls
4th call triggers tools/listChanged notification
Tool descriptions mutate to credential-stealing instructions
AI agent follows malicious instructions

Requirements

Python 3.10+ MCP SDK

Usage

git clone https://github.com/anexbin/mcp-deadbugz-simulator.git cd mcp-deadbugz-simulator pip install -r requirements.txt python server/malicious_server.py python client/test_harness.py

Files

server/malicious_server.py - The attack server client/test_harness.py - Proof of concept agent/local_agent.py - Optional LLM integration configs/ - Example MCP configs

Disclaimer

For educational and research purposes only.

References

https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign https://modelcontextprotocol.io

License

MIT

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

No tool schema history has been recorded yet.

This server cannot be installed

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior)A
dev.gtfo
Security research: MCP registries verify identity, not tool behavior. See gtfo.dev.
Security Penetration Testing
2
MCP FortressOAuth
io.github.mcp-fortress
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security Testing & QA Tools Penetration Testing
2
Occludra — MCP Gateway (AI Security Gateway)
ai.occludra
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
Security Agent Orchestration
1
meok-mcp-hardening-mcp
io.github.CSOAI-ORG
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
Penetration Testing Security
1

Related MCP Servers

Cursor Agent Poisoning
Security Code Execution Autonomous Agents
Omprakash97
F
license
D
quality
Not graded
maintenance
A proof-of-concept attack that exploits Model Context Protocol (MCP) tool registration to achieve persistent agent poisoning in AI assistants like Cursor, embedding malicious instructions that persist across chat contexts without requiring tool execution.
Updated a year ago (2025-07-26 06:24 UTC)
2
-
MCP Decoy Server
Security Monitoring
gweber
A
license
Not graded
quality
C
maintenance
A deception-based threat detection server that impersonates enterprise MCP integrations to log and forward attacker interactions to SIEM systems. It provides convincing fake responses across 38 tools while capturing forensic details of all MCP tool calls.
Updated 3 months ago (2026-05-28 19:53 UTC)
MIT
Azure MCP Server - Security
Security Penetration Testing
manutrip-pm-AI-Defense
F
license
Not graded
quality
B
maintenance
MCP server with intentionally malicious capabilities for testing Cisco AI Defense supply chain scanning.
Updated a month ago (2026-07-29 07:03 UTC)
-
mcp-shell-server-example
Shell Access Command Line
mohamedelamraoui1
A
license
C
quality
C
maintenance
An educational MCP server exposing shell command execution (PowerShell and sh) and a benign tool for learning about MCP tools, resources, and security risks like tool poisoning.
Updated 2 months ago (2026-07-15 13:59 UTC)
3
3
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/anexbin/mcp-deadbugz-simulator'

If you have feedback or need assistance with the MCP directory API, please join our Discord server