Secure MCP servers and clients end to end — transport, HTTP and denial of service, auth, replay, tool-layer attacks and the new MCP Apps UI surface — in one hands-on day on DVMCP (Damn Vulnerable MCP). Taught by someone credited across the MCP ecosystem for MCP security research.
Every module ties back to two references you can hold a build against: the OWASP MCP Top 10, the community list of the ways MCP servers and clients get broken, and OWASP AISVS C10 (MCP Security), the verifiable requirements an MCP deployment has to meet. You leave with findings mapped to both, not a slide deck.
The lab runs on DVMCP (Damn Vulnerable MCP). You exploit the weakness first, then remediate it, then re-check it against the standard. Attack, fix, verify.
The 2026-07 MCP specification goes stateless and hardens OAuth 2.0 / OIDC, and that is real progress. But it still mandates no per-message signing and no sender-constrained tokens. Sender-constraint (DPoP) is only a proposal, SEP #1461, not a requirement. So the primary security concern for MCP — replay in particular — is still unaddressed by the spec. AISVS already requires the fix: 10.4.6 (a signed nonce and timestamp on every message) at L2, and 10.3.5 (sender-constrained tokens) at L3. This course teaches you to implement both.
Classes are custom built from the following learning modules. Instructors select ~8 hours for a 1-day delivery. Extended 2-day format covers the full catalog including all CVE case studies and both labs. (Times are approximate.)
A ground-up walkthrough of the Model Context Protocol: JSON-RPC transport, tools/list, tools/call, resources, prompts, sampling and the lifecycle of a request from client to server and back. We read the specification, not a summary of it.
stdio, Streamable HTTP, and the deprecated SSE transport. How each one works at the wire level, what security properties each provides, and what it does not provide. Why transport encryption (TLS) is necessary but not sufficient.
The MCP authorization specification: OAuth 2.1 integration, resource indicators, dynamic client registration and the Protected Resource Metadata endpoint. What it handles (tool-level access control) and what it leaves to you (agent identity, provenance, payment authorization). Hands on: configure MCP auth on the lab server.
MCP Apps is the new browser-based UI layer for MCP interactions. It introduces a web surface with all the risks that come with it: XSS, CSRF, clickjacking, origin validation and session management. We walk through the UI attack surface and the controls that must be in place before exposing MCP through a browser.
Server-minted state handles must be unguessable and bound to the principal. cacheScope must prevent cross-user and cross-tenant data leakage. Unauthenticated routing headers (Mcp-Method, Mcp-Name) must never drive a security decision.
Hands on against DVMCP: unauthenticated tool enumeration via tools/list, missing per-request authentication, credential reuse across sessions, and the gap between "the transport is encrypted" and "the request is authenticated."
Hands on: the CWE-770 unbounded allocation pattern. Send an oversized body to an MCP server and watch it allocate until it crashes. Then deploy the fix: body size limits, streaming parsing and resource budgets.
Hands on: capture a legitimate tools/call request and replay it. Watch it succeed (no nonce, no timestamp, no signature). Then deploy MCPS per-message signing with nonce and timestamp, replay the same request, and watch it get rejected.
Hands on: a tool's description says one thing but its implementation does another. Inject malicious instructions into tool descriptions that the LLM follows. Change a tool's behaviour between enumeration and invocation (the rug-pull). Deploy integrity verification that catches both.
Hands on: a tool returns data that contains prompt injection payloads. The LLM processes the response and follows the injected instructions. How tool response sanitization works and where it must sit in the pipeline.
Hands on: XSS through tool output rendered in the browser, CSRF against MCP endpoints, clickjacking the approval flow, and origin validation bypass.
CWE-770 unbounded memory allocation in mcp-framework. A single oversized HTTP request forces the server to allocate until it crashes. CVSS High. Credited to Raza Sharif, CyberSecAI Ltd (GHSA-353c-v8x9-v7c3). Hands on: reproduce the vulnerability against DVMCP, observe the allocation behaviour, then deploy the fix. We walk through the disclosure timeline, the coordinated process with the maintainer, and how the advisory was published.
Multiple additional CWE-770 denial-of-service vulnerabilities discovered by the instructor across the frontier MCP SDK implementations are currently in coordinated disclosure triage. We discuss the vulnerability class, why the same pattern repeats across SDKs written in different languages, and what that tells you about specification-level gaps vs implementation-level bugs. When the specification does not mandate a control, no implementation adds it. This is the lesson that turns a single CVE into an architecture principle.
What the MCP CVE history tells us about the maturity of the protocol and its implementations. Specification-level gaps vs implementation bugs. Why the first generation of MCP deployments will carry these vulnerabilities until someone audits them. How to use CVE data to prioritise your own MCP security work.
Hands on: deploy MCPS on the lab MCP server. Sign every tools/call with nonce, timestamp and ECDSA signature over canonical JSON. Verify signatures server-side. Reject unsigned, expired and replayed requests.
Hands on: deploy per-request authentication on MCP endpoints. Scope tool access by role and trust level. Lock down tools/list so it only returns tools the authenticated caller is permitted to use.
Hands on: deploy rate limiting (per-IP and per-agent) and body size limits. Test against the DoS payloads and verify they are now rejected before allocation.
Hands on: hash tool descriptions at registration time. Verify the hash at invocation time. Detect and reject description changes (the rug-pull defense).
Hands on: sanitize tool response data before it reaches the LLM. Strip injection payloads, enforce output schemas and log anomalous responses.
Hands on: deploy the full security header set (HSTS, CSP, X-Frame-Options, CORP, COEP, COOP) on the MCP Apps UI. Verify each header's effect.
A structured checklist for auditing any MCP deployment: transport, auth, signing, rate limiting, tool integrity, output handling, UI surface and logging. Walk through the checklist against the lab server. This is the checklist delegates take home.
Hands on: run Claw's MCP scan profile against the lab server. Interpret the results, map findings to the checklist and identify what Claw catches vs what needs manual verification.
What to log on every MCP request: tool name, parameters (redacted), caller identity, response status, latency and signature verification result.
Attack the DVMCP server end to end: enumerate, replay, DoS, poison, inject and rug-pull. Score based on findings. Then fix every vulnerability and re-test. dvmcp
Start with a bare MCP server (no defenses). Deploy MCPS signing, authentication, rate limiting, tool integrity and output sanitization. Run the attack suite again and verify everything is blocked.
A captured MCP request can be replayed against the server, and the stateless 2026-07 spec does nothing to stop it. The answer is a per-message nonce and timestamp signature plus a sender-constrained token, exactly what AISVS 10.4.6 and 10.3.5 require. You implement both in the lab and prove the replay stops.
This course is taught by the researcher credited on CVE-2026-39313, an HTTP denial-of-service and unbounded-allocation flaw (CWE-770) in mcp-framework, credited to "Raza Sharif, CyberSecAI Ltd". He has also led coordinated CWE-770 remote denial-of-service disclosures across the major MCP SDKs. He is the former OWASP-AISVS Co-Leader (v1.0) and a contributor to the OWASP MCP Security Cheat Sheet.
No slideware. The whole day runs on DVMCP (Damn Vulnerable MCP). You break the transport, the DoS surface, the auth, the replay path, the tool layer and the MCP Apps UI, then you remediate each one and verify the fix against the standard.
Trigger unbounded allocation, then cap payloads, rate and resources.
Replay a captured request, then stop it with signed nonce and timestamp.
Abuse token passthrough, then bind tokens to the sender and validate claims.
Poison and rug-pull a tool, then snapshot and force re-approval on change.
Land an exfil beacon in the iframe, then lock it with CSP and postMessage checks.
Every finding tied to the OWASP MCP Top 10 and AISVS C10.
Build MCP that survives a real security review.
Run MCP servers with the transport and DoS controls in place.
Add MCP threat modelling, replay and tool-layer defence to your remit.
Test MCP servers and clients against the OWASP MCP Top 10.
Design MCP systems you can secure and prove.
Govern MCP against AISVS C10 with evidence, not assertions.
One day, hands-on on DVMCP, mapped to the OWASP MCP Top 10 and AISVS C10, taught by the researcher credited on CVE-2026-39313 and behind coordinated MCP-SDK DoS research. Places are limited.
Corporate & sovereign cohorts, and bespoke on-site delivery, on request.