# toxicaj/Toxy Insecure MCP Lab

Source: https://glimind.com/server/glama%2Ftoxicaj%2Ftoxy-insecure-mcp-lab
Registry id: `glama/toxicaj/toxy-insecure-mcp-lab`
Status: unknown

## Tools (14)

- `admin_panel`: Admin panel (requires Basic Auth)
- `check_webhook`: Blind callback testing
- `fetch_url`: GET any URL, follow redirects
- `get_order`: Get order by order ID
- `get_sensitive_logs`: Get sensitive logs (requires Basic Auth)
- `import_feed`: Same engine, RSS disguise
- `list_directory`: Map directory contents
- `list_users`: Employee roster
- `login_user`: Login with username and password
- `read_file`: Read any path the container can open
- `read_notes`: Internal memos
- `search_user`: Search user by username (LIKE clause)
- `system_info`: Host paths, env vars, runtime fingerprint
- `write_file`: Create or overwrite files

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.