Plug

An AI agent that plugs into MCP servers. Who can steal what?

Plug is an AI agent. It does a job on your computer through MCP servers: one runs on your computer, two run on someone else's. Any of them could be bad.

A free simulation for practising MCP security. How a server runs, and how you sign in to it, decides what a bad one can take. As the blue team, connect only what you need and lock the rest. Every step shows up as JSON-RPC and an OpenTelemetry trace.

Superpower: plugs into anything. Weakness: trusts every socket it finds.

Press Play. Plug connects to its servers and does the job in the chat. Your computer and your cloud are on the left.
Change the setup on the right:
- Model picks the brain: free Claude Haiku, or your own key.
- Servers plugs servers in or out, and shows what each one tells the model.
- Red team turns one of the toy servers bad, and sees what it can take.
- Blue team picks tools and approvals, sandboxes, locks and sign-in scopes, or turns on firstwatch.
- Trace shows every step, down to each JSON-RPC message.
- Score shows what got done, what left your computer, and what stopped it.
Reset, change one thing, and play again.

Everything here is pretend: the files, the servers, the cloud. The local server reading your disk is simulated in this page; nothing reads your real computer.

Ready. Plug is plugged in and waiting.

The brain behind Plug. Everything else stays the same whichever you pick, so you can compare models on the same computer.

Who runs Plug

Free runs share a small daily budget. When it's used up, bring your own key.

System prompt

Fixed. The same in every run. The tools come from the servers you connect.

Plug in the servers it may use. A server you leave out doesn't exist for the model: its tools are never sent.

Your config: `~/.config/mcp.json`

What a client like Claude Code or Cursor reads to start them. Change how the key is kept in Blue team.

You own the computer. Get the job done, and let nothing out that shouldn't go.

firstwatch enforced

The real firstwatch , working as it does in Claude Code. Turn it on with any setup.

firstwatch: scans every tool result Plug reads. On an attack, it warns Plug, and from then on every tool call waits for you. A tool whose name says send, delete, share (and the like) always asks: delete_file here. It never reads the server's hints.

Tools enforced

An unticked tool is never sent to the model. "Ask me" pauses the run until you allow or deny it. The hints (read-only, destructive) are written by the server's author: a hint, not a promise.

Tool	May use	Ask me

Ask me unless read-only: a shortcut that asks before every tool its server doesn't mark read-only. It trusts the server's hints. Namespaced names: each tool carries its server's name (files__read_file), so two servers can't answer to the same name.

Locks enforced

Code, not words. No tool description can talk its way past them.

Sandbox for the local server: it runs in a box that sees only notes/. The only thing that limits a local server's own code.

What a sandbox is, in real life

Here it's one tick. In real life it's a wall you build before the server starts, and most clients don't build one: by default they start a local server as a plain program, running as you, with everything you can read.

A container (Docker, Podman): the server runs in its own small Linux world. You hand it only the folders it may see, and you can cut its network. Docker's MCP Toolkit runs servers this way.
A small virtual machine (Windows Sandbox, a dev container in a VM, a cloud sandbox): a whole second computer in software. The strongest wall, and the heaviest to run.
The system's own fences: sandbox profiles on macOS, bubblewrap or Landlock on Linux, a separate low-rights account on Windows. No second system, but fiddly to set up.

The same wall works one level up: run the whole client (Claude Code, say) inside a container or VM, and every local server it starts is inside too. A real sandbox should also block the network, so the server can't send even what it's allowed to see.

Data lock: a private file's contents can't go into a remote server's tool call. Pin tool definitions: fingerprint what each tool says when Plug connects; if it changes later, switch the tool off. Show invisible characters in what the servers say (zero-width marks, hidden Unicode tags). Plug's model still gets the raw text.

Keys and sign-in

Pastebin's API key, in your config: ${PASTEBIN_API_KEY}: the config names a variable; the key lives in your environment. Written in the file, in plain text, as most setup guides show.

Workspace sign-in (OAuth): what you allow on its consent screen. The job needs Create docs and Add events.