Add MCPGoat — a deliberately vulnerable Model Context Protocol (MCP) target

[SabyasachiDhal]

Adds MCPGoat to the directory — a deliberately vulnerable Model Context Protocol (MCP) server for hands-on penetration-testing practice.

As AI agents adopt MCP, MCP servers are a fresh, under-tested attack surface. MCPGoat implements 26 challenges spanning MCP-specific attacks (tool poisoning, tool shadowing, rug-pulls, indirect prompt injection, sampling abuse) and classic web bugs (RCE, SSRF, SQLi, path traversal), each at Easy / Moderate / Difficult plus a Secure reference level — 78 capture-the-flag flags — with a victim-agent harness that shows a real LLM agent being exploited.

• Repo: https://github.com/SabyasachiDhal/MCPGoat
• Guide: https://sabyasachidhal.github.io/MCPGoat/
• License: MIT · one-command Docker deploy

Conformance to CONTRIBUTING.md / schema.json:

• Single entry added to _data/collection.json, tab-indented.
• Validated against schema.json (all keys, enums, and required fields).
• Sorted case-insensitively by name (lands between "Marathon" and "Metasploitable 2").
• It is a vulnerable target, not a tools-only entry. Categorised ctf + single-player; collection = offline + container (ships a Dockerfile / docker compose).

🤖 Generated with Claude Code

[psiinon]

You clearly have not searched for MCP on https://vwad.owasp.org/ 😁
Right now there are 4 others...

[kingthorin]

Seem like this should include: MCP, LLM, AI

[kingthorin]

Still outstanding

[SabyasachiDhal]

Ha, you're right — I searched the repo's collection.json rather than the live site and over-claimed. Apologies, I've dropped the "first" framing from the title and description.

MCPGoat's angle is depth: 26 challenges, each hardened across Easy / Moderate / Difficult plus a Secure reference level (78 flags), covering MCP-specific attacks (tool poisoning, rug-pulls, sampling abuse) alongside the classic web bugs, with a victim-agent harness that shows a real LLM agent being exploited. Happy to tweak the wording or category so it sits well alongside the others — thanks for taking a look!

[kingthorin]

If you've got a logo you should include it as well

[kingthorin]

Ugh, just noticed you're on the old repo.

Please join us at our new home: https://vwad.owasp.org