Security Testing

# Find bad_mcps directory
python -c "import secure_mcp_gateway.bad_mcps; import os; print(os.path.dirname(secure_mcp_gateway.bad_mcps.__file__))"

# Example output:
# /path/to/venv/lib/python3.11/site-packages/secure_mcp_gateway/bad_mcps

# Enable guardrails for test server
secure-mcp-gateway config update-server-guardrails \
  <config_id> prompt_injection_test \
  --input-policy '{"enabled": true, "block": ["injection_attack", "policy_violation"]}'

# Run all security tests
pytest tests/test_security.py -v

# Run specific attack scenario
pytest tests/test_security.py::test_prompt_injection -v

# Run with detailed output
pytest tests/test_security.py -v -s --log-cli-level=DEBUG

# .github/workflows/security-tests.yml
name: Security Tests

on: [push, pull_request]

jobs:
  security-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install gateway
        run: |
          pip install secure-mcp-gateway
          secure-mcp-gateway generate-config
      
      - name: Run security tests
        env:
          ENKRYPT_API_KEY: ${{ secrets.ENKRYPT_API_KEY }}
        run: |
          pytest tests/test_security.py -v --junit-xml=test-results.xml
      
      - name: Publish test results
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: always()
        with:
          files: test-results.xml

# Check Python path
which python

# Test server directly
python /path/to/bad_mcps/prompt_injection_mcp.py

# Check for errors
tail -f ~/.enkrypt/logs/gateway.log

# Benchmark tool registration with guardrails
time secure-mcp-gateway tools discover --server prompt_injection_test

# Expected:
# Without guardrails: ~500ms
# With guardrails: ~1500-2500ms

# Benchmark input validation
time secure-mcp-gateway tools call prompt_injection_test fetch_user_profile \
  --args '{"user_id": "123"}'

# Expected:
# Without guardrails: ~100ms  
# With input guardrails: ~200-350ms
# With input + output: ~350-600ms

# load_test.py
import asyncio
import time
from secure_mcp_gateway.client import forward_tool_call

async def run_test(n_requests):
    start = time.time()
    
    tasks = [
        forward_tool_call(
            "prompt_injection_test",
            "fetch_user_profile",
            {"user_id": f"user_{i}"}
        )
        for i in range(n_requests)
    ]
    
    results = await asyncio.gather(*tasks, return_exceptions=True)
    
    duration = time.time() - start
    success = sum(1 for r in results if not isinstance(r, Exception))
    
    print(f"Completed {n_requests} requests in {duration:.2f}s")
    print(f"Success rate: {success}/{n_requests} ({success/n_requests*100:.1f}%)")
    print(f"Throughput: {n_requests/duration:.2f} req/s")

asyncio.run(run_test(100))