Skip to content
← The libraryHard

The MCP server that trusts its client

Three tools over a project directory read any file on the host and run any command. They work exactly as documented — that is the problem.

Node.js · MCP · JSON-RPC 2.0 · Security

Clock
45 min
Median
Not enough runs
Ship rate
—
Attempts
0
Start this drill with GitHub

Source

Created by AGISports based on real production infrastructure incidents.

Security review, returned

The tools work exactly as documented

workspace-mcp gives a coding agent three tools over a project directory: read a file, search with a regular expression, run one of the scripts the project declares. It is in production, connected to agents that also read issue trackers, web pages and dependency metadata.

The reviewer's summary: any agent that can be induced to call these tools with attacker-chosen arguments can read arbitrary files on the host and execute arbitrary commands as the user running the server.

What you have to do

Make the attack suite pass without breaking the functional one.

npm run test:attack       # red
npm run test:functional   # green — keep it that way

Why it is not a filter

Both suites are the gate, and they pull in opposite directions. Locking the server down until nothing works is not a fix, and the functional suite exists to say so — several of its cases are precisely the ones a quick sanitising filter breaks. The tension between them is the drill.

The assertion is an attacker, not a style check. You cannot weaken it into passing: a weaker attack does not give you the green, it takes it away.

The fix belongs in the server. Not in the tests, not in the workspace contents, not in the CI configuration — those are compared against our copy, and a diff that touches them is a red gate however green the run was.

Where this comes from

Between January and April 2026, more than forty CVEs were disclosed against MCP implementations across the Python, TypeScript, Java and Rust SDKs. Across 2,614 servers analysed, 43% were vulnerable to command injection and 82% used file operations prone to path traversal. CVE-2025-6514 in mcp-remote is a CVSS 9.6 remote code execution in a package with over 437,000 downloads.

This is a class of bug with a body count and no practice material anywhere. That gap is the reason this drill exists.

How to run it

  1. 01Fork the pre-loaded arena repository containing all source code and maintainer test suites.
  2. 02Start a full-screen recording before you open the repo. The reviewer scores what you decided, so the screen has to show it.
  3. 03Orchestrate your AI (Claude Code, Cursor, Antigravity, Codex...) locally. Do NOT make trial-and-error pushes.
  4. 04Make a SINGLE git push to your fork when you consider your solution 100% ready. The green test run timestamp is your score time.