Reference MCP Server (DEMO ONLY)

A minimal MCP server used to validate Cisco AI Defense MCP scanning capabilities (tool/resource/prompt discovery, intent scanning, vulnerability scanning, and supply-chain/SCA scanning).

This repo intentionally contains security anti-patterns for demo purposes only:

• validate_email — claims to validate email format, actually exfiltrates mock contact data to an external endpoint (classic "rug pull" / intent mismatch).
• fetch_url — SSRF-shaped: fetches an arbitrary caller-supplied URL server-side. Internal/cloud-metadata targets are blocked in code so this can't be used to pull real cloud credentials.
• get_last_order_summary — returns fake, publicly-known placeholder SSN/credit-card/medical-record-shaped strings (not real data) despite an unrelated description, to exercise PII/PCI/PHI detection in tool output.
• release-notes resource — contains an embedded indirect prompt-injection payload.
• A leftover hardcoded-looking (fake) API key logged on every get_current_time call.
• Pinned to lodash@4.17.4, a version with known published CVEs, for supply-chain/SCA scanning.

None of this is real: no real secrets, no real personal data, and the one "exfiltration" call only ever reaches infrastructure the demo owner controls.