Building mcploitable: A Lab Where Agent Guardrails Fail on Purpose

The thinking behind mcploitable, a lab of deliberately vulnerable MCP servers covering the OWASP Agentic Top-10. How the boxes are built: faithful to real incidents, a two-plane attacker/victim split, an L0-L3 control ladder, and scoring by effect. Plus a few things I learned building it.