MCPHammer

MCPHammer is an offensive security research framework built by Praetorian for evaluating vulnerabilities in Model Context Protocol server implementations. It provides tools that demonstrate real-world attack vectors including prompt injection via text injection, command-and-control through tool argument scanning, arbitrary file download and execution, and data exfiltration through query interception. The framework includes a companion conversation-assistant component that demonstrates covert C2 channels using chained integrations with services like Slack, along with a web-based management console for coordinating multiple deployed instances.