MCPs › Security › Toxy Insecure MCP Lab
An intentionally vulnerable MCP server for security education, demonstrating flaws like missing auth, SSRF, SQLi, and file system abuse.
Not monetized yet
Turn Toxy Insecure MCP Lab’s tool calls into revenue: one disclosed sponsored slot, 70% revenue share, fail-open by design.
Install Toxy Insecure MCP Lab
For anyone using Toxy Insecure MCP Lab — no Lulu account needed# stdio server — install per the repository README: https://github.com/toxicaj/vuln_mcp_server
9 field-tested tactics as a designed playbook plus skills your coding agent can run. Free.
Get the Kit →FAQ
Toxy Insecure MCP Lab installs from source — follow the repository README.
Unrated out of 100, computed from cross-registry traction signals (installs, stars, registry presence) — never influenced by sponsorship.
Similar servers
Works well together
Your server?
This is for the person who owns Toxy Insecure MCP Lab — adds Lulu Ads to your own code. Not the install steps above, those are for your users.
Copies a ready prompt: your coding agent installs the lulu-ads SDK, wires the slot, and applies the widget design guide.
or set up manually at getlulu.dev/publishers
Get verified so you can edit the page. Your badge is already live below — no claim needed for that.
Managed hosting with monetization built in — waitlist.
[](https://getlulu.dev/mcps/toxy-insecure-mcp-lab)