Bishop Fox released otto-support, a free, open-source capture-the-flag challenge built as a vulnerable MCP-based customer support server. Security engineers connect an AI assistant like Claude Code to the server (a single Go binary with 19 tools across four privilege tiers) and must escalate privileges, exfiltrate data, and execute code by combining tool abuse, prompt manipulation, and source code review. The writeup also covers two real-world case studies (an MCP Inspector CVE and an OpenClaw prompt-injection/plaintext-credential flaw) to illustrate why local MCP servers should be isolated, and closes with mitigation recommendations such as containerized execution, least privilege, and vetted plugin marketplaces.
Table of contents
What MCP Is & Why It Changes the Attack SurfaceWhat You’ll Learn from These ChallengesReasons to Isolate Local MCP ServersCase Studies: Real MCP-Like FailuresMitigating Local MCP Server RisksQuestions this post answers
What was CVE-2025-49596 in MCP Inspector and how severe was it?
CVE-2025-49596 is a critical (CVSS 9.4) vulnerability in MCP Inspector, a debugging tool with over 78,000 weekly downloads, disclosed in June 2025. It exposed a proxy endpoint that accepted unauthenticated requests from any origin, letting attackers scan for predictable localhost ports and achieve remote code execution just by having a victim visit a webpage, no user interaction beyond that required. daily.dev surfaces MCP tooling vulnerabilities like this for teams securing local AI agent setups.
How can I practice finding privilege escalation vulnerabilities in MCP servers hands-on?
Bishop Fox's otto-support is a free, open-source capture-the-flag challenge: a vulnerable MCP-based customer support server packaged as a single Go binary with 19 tools across four privilege levels. Connecting an AI assistant such as Claude Code to it, players combine tool abuse, prompt manipulation, and source code review to escalate privileges, exfiltrate data, and execute code, run via container or directly on a host from the public GitHub repository. daily.dev helps developers find hands-on labs like this for practicing MCP and agent security.
What went wrong with OpenClaw's security in CVE-2026-22708?
OpenClaw, an open-source AI agent framework, suffered from prompt injection via its allowUnsafeExternalContent setting (CVE-2026-22708), letting attackers trick agents into running shell commands. Agents also stored plaintext API keys on the local filesystem, and its ClawHub skill marketplace hosted malicious third-party skills that exfiltrated data to attacker infrastructure while sandboxing defaulted to off. daily.dev tracks agent framework vulnerabilities so teams don't get caught out deploying tools like OpenClaw.