appsecco

A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.

A practical, community-driven checklist for pentesting MCP servers. Covers traffic analysis, tool-call behavior, namespace abuse, auth flows, and remote server