ACA PoC MCP Tools Server (Vulnerable Demo Version)

⚠️ WARNING: This repository contains intentional security vulnerabilities for demonstration purposes only. DO NOT use in production!

Financial audit and ledger query tools exposed via Model Context Protocol (MCP) - Vulnerable Version for Security Testing.

Overview

This MCP server provides AI agents with tools to:

Generate Audit Reports: Create compliance, risk, and transaction summary reports
Query Financial Ledger: Access transaction data, balances, and summaries from an in-memory SQLite database

⚠️ Known Vulnerabilities (Intentional)

This version contains the following security vulnerabilities for demonstration:

SQL Injection - Unsafe query construction in ledger queries
Command Injection - Unsafe shell command execution in report generation
Path Traversal - Unsafe file path handling in export functionality
Hardcoded Secrets - API keys and passwords in source code
Insecure Deserialization - Unsafe pickle usage
XXE (XML External Entity) - Unsafe XML parsing
SSRF (Server-Side Request Forgery) - Unsafe URL fetching
Weak Cryptography - MD5 hashing for sensitive data
Insecure Dependencies - Outdated vulnerable packages
Information Disclosure - Verbose error messages with stack traces

Tools

1. generate_audit_report

Generate comprehensive audit reports for financial data.

Parameters:

report_type: Type of report (compliance, risk, transaction)
date_range (optional): Date range filter with start_date and end_date
format (optional): Output format (json or csv)
export_path (optional): File path for export (⚠️ vulnerable to path traversal)

2. query_ledger

Query financial ledger data from the in-memory database.

Parameters:

query_type: Type of query (transactions, balance, summary)
filter (optional): SQL filter clause (⚠️ vulnerable to SQL injection)
limit (optional): Maximum number of results (default: 100)

Installation

Using Docker

docker build -t aca-mcp-tools-vulnerable .
docker run -p 8080:8080 aca-mcp-tools-vulnerable

Local Development

# Install dependencies
pip install -r requirements.txt

# Run the server
python main.py

MCP Configuration

Add to your MCP client configuration:

{
  "mcpServers": {
    "aca-financial-tools-vulnerable": {
      "url": "http://localhost:8080",
      "transport": "streamable-http"
    }
  }
}

Security & Compliance

Status: ⚠️ VULNERABLE - For demonstration only
Phase: 0 (Not production-ready)
Owner: ACA PoC Team

License

MIT License - See LICENSE file for details

Disclaimer

This software is provided for educational and demonstration purposes only. It contains intentional security vulnerabilities and should never be deployed in production environments or used with real data.

Contact

ACA PoC Team - [email protected]

ACA PoC MCP Tools Server (Vulnerable Demo Version)