A deliberately vulnerable MCP application for learning MCP security through hands-on exercises covering OWASP MCP Top 10 categories.
Getting started
Add MCP Goat to your MCP-capable client — Claude Code, Cursor, Codex, and others — by following the setup at the source, which documents the exact command, configuration, and any required API keys.
