Suraj-Chaudhary/test-remote-mcp-server
highA dummy mcp server
This MCP server provides a simple expense tracking system that allows users to add, list, and summarize expenses stored in a local SQLite database. It...
130mcp.run(transport="http", host = "0.0.0.0", port = 8000)// Network-exposed MCP: any network attacker can exploit this.
The server binds to 0.0.0.0, making it accessible from any network interface. Combined with HTTP transport (no encryption or authentication), this exposes the expense tracking tools to any network attacker.
ImpactAn attacker on the network can call add_expense, list_expenses, summarize, and read the categories resource without any authentication, potentially inserting fraudulent expenses or extracting sensitive financial data.
FixBind to 127.0.0.1 (localhost) only, or use a secure transport (e.g., HTTPS with authentication). If remote access is required, implement proper authentication and authorization.
59async def list_expenses(start_date, end_date):
60 '''List expense entries within an inclusive date range.'''
61 try:
62 async with aiosqlite.connect(DB_PATH) as c:
63 cur = await c.execute(
64 """
65 SELECT id, date, amount, category, subcategory, note
66 FROM expenses
67 WHERE date BETWEEN ? AND ?
68 ORDER BY date DESC, id DESC
69 """,
70 (start_date, end_date)
71 )// Network-exposed MCP: any network attacker can exploit this.
The start_date and end_date parameters are not validated for format or range. While parameterized queries prevent SQL injection, invalid date strings could cause errors or unexpected behavior. More importantly, an attacker could supply extremely large date ranges to extract all data.
ImpactAn attacker could list all expenses by providing a wide date range (e.g., '0001-01-01' to '9999-12-31'), leading to information disclosure of all stored expenses.
FixValidate that start_date and end_date are valid ISO 8601 date strings (e.g., YYYY-MM-DD) and optionally enforce a reasonable range limit.
42async def add_expense(date, amount, category, subcategory="", note=""):
43 '''Add a new expense entry to the database.'''
44 try:
45 async with aiosqlite.connect(DB_PATH) as c:
46 cur = await c.execute(
47 "INSERT INTO expenses(date, amount, category, subcategory, note) VALUES (?,?,?,?,?)",
48 (date, amount, category, subcategory, note)
49 )// Network-exposed MCP: any network attacker can exploit this.
The amount parameter is not validated to be a positive number. An attacker could insert negative amounts, zero, or non-numeric values (though SQLite may coerce them). This could corrupt financial summaries.
ImpactAn attacker could insert fraudulent expenses with negative amounts to skew summaries or cause confusion.
FixValidate that amount is a positive number (e.g., amount > 0) and that date is a valid date string.