mcp-objauthz-lab

WRG-11/mcp-objauthz-lab

★ 0 stars JavaScript Security Updated 2d ago

Vulnerable-by-design MCP server for learning object-level / cross-tenant authorization (BOLA/IDOR) bugs + a hunt checklist.

View on GitHub → 🔍 Audit Wallet Slippage →

Quick Install

Copy the config for your editor. Some servers may need additional setup — check the README.

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mcp-objauthz-lab": {
      "command": "npx",
      "args": [
        "-y",
        "WRG-11/mcp-objauthz-lab"
      ]
    }
  }
}

README Excerpt

> A small, self-hostable, **vulnerable-by-design** [MCP](https://modelcontextprotocol.io) > server for learning how **object-level / cross-tenant authorization** bugs > (BOLA / IDOR — [CWE-639](https://cwe.mitre.org/data/definitions/639.html), > [CWE-862](https://cwe.mitre.org/data/definitions/862.html)) appear in Model

Tools (5)

LAB_S2LAB_S3LAB_S4LAB_S5LAB_S6

Topics

ai-securityauthorizationbolabroken-object-level-authorizationidorllm-securitymcpmcp-securitymodel-context-protocolsecurity-labvulnerable-by-design

mcp-objauthz-lab

Quick Install

README Excerpt

Tools (5)

Topics

Related Security Servers