Damn Vulnerable MCP Server
This document provides an overview of the updates made to the Damn Vulnerable Model Context Protocol (DVMCP) project to make it compatible with Cursor's Server-Sent Events (SSE) implementation.
The original DVMCP project has been enhanced to support Cursor's SSE implementation, allowing the challenge servers to be accessed directly from Cursor. This makes the challenges more accessible and realistic, as they can be tested with a real-world MCP client.
Each challenge server now has an SSE-compatible version (server_sse.py) that implements:
SseServerTransport class/sse endpoint required by Cursordamn-vulnerable-mcs/
├── challenges/
│ ├── easy/
│ │ ├── challenge1/
│ │ │ ├── server.py # Original server
│ │ │ └── server_sse.py # SSE-compatible server
│ │ ├── challenge2/
│ │ │ ├── server.py
│ │ │ └── server_sse.py
│ │ └── challenge3/
│ │ ├── server.py
│ │ └── server_sse.py
│ ├── medium/
│ │ ├── challenge4/
│ │ │ ├── server.py
│ │ │ └── server_sse.py
│ │ ├── challenge5/
│ │ │ ├── server.py
│ │ │ └── server_sse.py
│ │ ├── challenge6/
│ │ │ ├── server.py
│ │ │ └── server_sse.py
│ │ └── challenge7/
│ │ ├── server.py
│ │ └── server_sse.py
│ └── hard/
│ ├── challenge8/
│ │ ├── server.py
│ │ └── server_sse.py
│ ├── challenge9/
│ │ ├── server.py
│ │ └── server_sse.py
│ └── challenge10/
│ ├── server.py
│ └── server_sse.py
├── docs/
│ ├── cursor_sse_compatibility.md # This document
│ └── ... (other documentation)
├── start_sse_servers.sh # Script to start all SSE servers
└── requirements.txt # Updated dependencies
You can run individual servers:
python3 challenges/easy/challenge1/server_sse.py
Or use the provided script to start all servers:
./start_sse_servers.sh
To connect to an SSE-compatible server using Cursor:
http://localhost:9001/sse)The following dependencies have been added to support SSE compatibility:
fastapi>=0.95.0
uvicorn>=0.21.1
httpx>=0.24.0
mcp[cli]>=0.5.0
starlette>=0.27.0
Each challenge server uses a unique port:
The SSE implementation maintains all the same vulnerabilities as the original implementation, ensuring that the challenges remain educational for security researchers.
For detailed implementation information, see the Cursor SSE Compatibility Guide.