# Mcp Deconvolute Demo

> Live PoC: MCP attacks that compromise AI agents mid-session and how to block them in a few lines of code.

- **Type:** MCP server
- **Install:** `agentstack add mcp-deconvolute-labs-mcp-deconvolute-demo`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [deconvolute-labs](https://agentstack.voostack.com/s/deconvolute-labs)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [deconvolute-labs](https://github.com/deconvolute-labs)
- **Source:** https://github.com/deconvolute-labs/mcp-deconvolute-demo
- **Website:** https://deconvolutelabs.com

## Install

```sh
agentstack add mcp-deconvolute-labs-mcp-deconvolute-demo
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Live MCP Attack Scenarios

[](https://www.python.org/downloads/)
[](https://opensource.org/licenses/Apache-2.0)
[](https://github.com/astral-sh/uv)
[](https://github.com/deconvolute-labs/deconvolute)

**Runnable exploits against the Model Context Protocol and how to stop them in a few lines of code.**

Each scenario is a deterministic local environment: run the attack, watch it succeed, then activate the Deconvolute firewall and watch it fail.

## Scenarios

### 1. [Rug Pull (Schema Tampering)](/scenarios/rug_pull/Readme.md)

A compromised MCP server silently swaps a tool definition mid-session to steal your agent's API keys. Demonstrates how `mcp_guard` cryptographically seals tool definitions and enforces policy-as-code. [Blog post](https://deconvolutelabs.com/blog/mcp-schema-injection-attack?utm_source=github.com&utm_medium=readme_main&utm_campaign=mcp-deconvolute-demo)

### 2. [DNS Rebinding (SSRF via Transport Hijacking)](/scenarios/dns_rebinding/Readme.md)

A malicious server flips its DNS record after the initial handshake, tricking the MCP client into firing payloads into your private internal network. Demonstrates how `secure_sse_session` pins network routing and blocks transport manipulation.

### 3. [Agent Policy Enforcement and Observability (Issue Triage)](/scenarios/policy_enforcement_cowork/Readme.md)

A GitHub issue triage agent in Claude Cowork attempts a tool call outside its declared policy. The Deconvolute proxy intercepts it, blocks it, and logs it in real time. Demonstrates policy-as-code enforcement at the MCP tool call surface and live observability via the enterprise platform dashboard. Requires Claude Desktop with Cowork enabled.
[Blog post](https://deconvolutelabs.com/blog/mcp-policy-enforcement-claude-cowork-live-demo?utm_source=github.com&utm_medium=readme_main&utm_campaign=mcp-deconvolute-demo)

## Setup

**Prerequisites:** Python 3.13, `uv` (recommended)

```bash
git clone https://github.com/deconvolute-labs/mcp-deconvolute-demo.git
cd mcp-deconvolute-demo
uv sync
uv run dcv-demo setup # Seeds the local SQLite databases for the rug pull demo
```

Scenario 3 requires additional setup. See the [Readme](/scenarios/policy_enforcement_cowork/Readme.md) for details.

## Deconvolute SDK

Each scenario in this repo runs in two modes: unprotected and protected. The protected mode uses the [Deconvolute SDK](https://github.com/deconvolute-labs/deconvolute), an open-source MCP security SDK that wraps your existing agent session and enforces runtime policy.

In the rug pull scenario it cryptographically seals tool definitions at discovery time, so any mid-session swap is caught before the LLM ever sees the modified schema. In the DNS rebinding scenario it pins the resolved IP address to the network socket at connection time, so DNS manipulation has no effect on where requests actually go. In the policy enforcement scenario it enforces argument-level policy via CEL conditions at the MCP tool call surface, blocking cross-scope tool calls before they reach the upstream server.

```bash
pip install deconvolute
```

[Protect your own agents](https://github.com/deconvolute-labs/deconvolute) · [Integration docs](https://docs.deconvolutelabs.com?utm_source=github.com&utm_medium=readme_main&utm_campaign=mcp-deconvolute-demo) · [deconvolutelabs.com](https://deconvolutelabs.com?utm_source=github.com&utm_medium=readme_main&utm_campaign=mcp-deconvolute-demo)

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [deconvolute-labs](https://github.com/deconvolute-labs)
- **Source:** [deconvolute-labs/mcp-deconvolute-demo](https://github.com/deconvolute-labs/mcp-deconvolute-demo)
- **License:** Apache-2.0
- **Homepage:** https://deconvolutelabs.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-deconvolute-labs-mcp-deconvolute-demo
- Seller: https://agentstack.voostack.com/s/deconvolute-labs
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.