Mcpwn

Mcpwn is a security scanner designed to generate and inject malicious payloads into target Model Context Protocol (MCP) servers. Its core function involves executing external processes via `subprocess.Popen` and `subprocess.run` to interact with target servers. While this is inherent to its purpose, users should be aware that running it against untrusted or production systems without permission can have severe consequences, as it actively attempts to exploit vulnerabilities. The code itself does not show direct `eval` or intentional self-harm. API keys for LLM integration are mentioned to be handled via environment variables or CLI flags, indicating good practice. Local network listeners (HTTP, DNS) are started for OOB/SSRF detection, which is part of its legitimate testing functionality and not a vulnerability within Mcpwn itself.