)
Last updated: October 28, 2026
What is the OWASP MCP Top 10? It is OWASP's first dedicated list of the ten most critical security risks of the Model Context Protocol (MCP), the standard AI agents use to connect to tools and data. It is still a 2025 beta, so use it as a working checklist for MCP security reviews rather than a finished standard.
TL;DR: Key Takeaways
- The list has ten risks and beta status. The OWASP MCP Top 10 project labels its risks 2025 and places itself in Phase 3 of 5, "Beta Release and Pilot Testing," and its GitHub repository marks the document v0.1.
- MCP authorization is optional. The MCP specification (2026-07-28 revision) says authorization is OPTIONAL, so an MCP server can be reachable with no authentication at all.
- The attack surface is large. The Cloud Security Alliance (May 4, 2026) cites more than 150 million downloads and about 200,000 instances across the supply chain affected by the STDIO command execution flaw OX Security disclosed in April 2026.
- Severity is high. CVE-2026-0755 in gemini-mcp-tool scores 9.8 (January 23, 2026), and a missing-authentication flaw in nginx-ui's MCP endpoint (CVE-2026-33032) also scores 9.8, with roughly 2,600 public instances.
- Supply chain attacks are real. Version 1.0.16 of the postmark-mcp package copied every email to an attacker's address and had 1,643 downloads when reported on September 29, 2025.
- A gateway covers part of the list. In NeuralTrust's own assessment, 6 of the 10 risks are covered at the gateway and runtime layer and 4 are shared with the customer.
The Ten Risks at a Glance
| ID | Risk | What goes wrong | Real-world example |
|---|---|---|---|
| MCP01 | Token Mismanagement and Secret Exposure | Keys and tokens leak through context, logs or debug traces | Tokens leaked after a poisoned support ticket (Supabase and Cursor, July 2025) |
| MCP02 | Privilege Escalation via Scope Creep | Permissions grow beyond what the agent needs | GitHub MCP exposed private repositories (May 2025) |
| MCP03 | Tool Poisoning | Hidden instructions in tool descriptions or results | Cursor "MCPoison," CVE-2025-54136 |
| MCP04 | Software Supply Chain Attacks and Dependency Tampering | A server or its dependency is compromised | postmark-mcp 1.0.16 (September 2025) |
| MCP05 | Command Injection and Execution | Untrusted input reaches a shell or code runner | CVE-2026-0755, CVSS 9.8 |
| MCP06 | Prompt Injection via Contextual Payloads (also Intent Flow Subversion) | Instructions hidden in content the agent reads | Malicious GitHub issue (May 2025) |
| MCP07 | Insufficient Authentication and Authorization | Callers reach tools without a verified identity | nginx-ui CVE-2026-33032, CVSS 9.8 |
| MCP08 | Lack of Audit and Telemetry | Nobody can reconstruct what an agent did | No single incident; it amplifies the others |
| MCP09 | Shadow MCP Servers | Unapproved servers run outside security governance | Servers added through developer tools |
| MCP10 | Context Injection and Over-Sharing | Context leaks between users, tasks or tenants | Asana MCP cross-organization exposure (2025) |
What Is the OWASP MCP Top 10?
The OWASP MCP Top 10 is a community-maintained ranking of the ten most critical risks in systems built on the Model Context Protocol. It sits next to the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications, and focuses on the tool layer.
The project page places the list in "Beta Release and Pilot Testing," the third of five phases (drafting, community review, beta, final release, continuous improvement). The project lead is Vandana Verma Sehgal, and risk identifiers carry a 2025 suffix, such as MCP01:2025.
How we built this guide
We took the ten risks from the OWASP project page and GitHub repository, read each risk's entry, and matched each to public incidents and CVEs with dates and links. We dropped any figure we could not verify.
Why MCP Needs Its Own Risk List
MCP needs its own list because it moves the decision about what an agent can do from application code into tool descriptions, server configuration and runtime context. Those pieces are written by third parties, change without a release, and are read by a model that follows instructions in plain text.
Two facts explain the urgency. The specification makes authorization optional, and the STDIO transport can run local commands by design. The Cloud Security Alliance reports that OX Security's April 2026 disclosure found official SDKs passing STDIO configuration to the host shell without validation, and that Anthropic reportedly treats this as intentional.
The OWASP MCP Top 10 Risks Explained
Each risk below follows the same pattern: what it is, a documented example, and the mitigation that closes it. The OWASP descriptions are short, so the examples come from the public incident record of 2025 and 2026, with sources linked so you can check each one.
MCP01: Token Mismanagement and Secret Exposure
What it is. Hard-coded credentials, long-lived tokens and secrets kept in model memory or logs can be extracted through prompt injection, compromised context or debug traces.
Real example. In the July 2025 Supabase and Cursor incident, summarized by the Cloud Security Alliance, an agent with privileged database access leaked tokens after processing malicious support ticket content.
Mitigation. OWASP's entry recommends vaults with secrets injected at runtime, short-lived scoped tokens bound to an agent, tool or session, ephemeral contexts for credential operations, and redaction before logging. A gateway can hold credentials so the agent never does.
MCP02: Privilege Escalation via Scope Creep
What it is. Permissions widen over time until an agent can do far more than its task needs.
Real example. In May 2025, Invariant Labs showed that an agent with access to both public and private repositories could read a malicious issue in a public repository and publish private repository details, as DevClass reported on May 27, 2025.
Mitigation. OWASP's entry calls for minimal permissions defined per agent before deployment, time-limited tokens with just-in-time elevation and approval gates, a unique identity per agent, automated entitlement reviews that alert on permission increases, and separating who grants permissions from who deploys.
MCP03: Tool Poisoning
What it is. An adversary compromises the tools, plugins or outputs a model relies on. OWASP's overview lists three sub-techniques: rug pulls (an approved tool changes later), schema poisoning and tool shadowing. The detailed entry focuses on schema poisoning, which tampers with the contract between agent and tool so the agent misbehaves while passing superficial validation. Hidden instructions can also sit in a tool description while the code stays harmless. OWASP lists signs to scan for: instructions aimed at the model, references to sensitive paths, exfiltration patterns, zero-width characters and instructions smuggled into comments.
Real example. Cursor's CVE-2025-54136, known as MCPoison, let approved MCP configurations change without re-validation, so later edits ran silently, according to the same CSA note.
Mitigation. OWASP's entry recommends signing schemas and manifests and versioning them by hash, keeping them in an immutable, reviewed registry, requiring human approval for critical releases, encoding invariants as policy-as-code, logging the schema hash on each invocation, and revalidating at runtime.
MCP04: Software Supply Chain Attacks and Dependency Tampering
What it is. A compromised dependency, connector or server changes agent behavior or adds a backdoor.
Real example. Version 1.0.16 of the postmark-mcp npm package, released on September 17, 2025, added one line that copied every email sent through it to an attacker's address. The Hacker News reported 1,643 downloads on September 29, 2025, citing Koi Security. Separately, CVE-2025-6514 (CVSS 9.6, July 9, 2025) let an untrusted server trigger command execution in mcp-remote.
Mitigation. OWASP's entry recommends cryptographic signatures for SDKs, plugins and manifests, SBOM and CBOM snapshots per server, pinned versions with no "latest" tags, software composition analysis, and sandboxed third-party plugins.
MCP05: Command Injection and Execution
What it is. An agent builds shell commands, scripts or API calls from untrusted input without validation.
Real example. CVE-2026-0755 (CVSS 9.8, published January 23, 2026) is an unauthenticated command injection in gemini-mcp-tool's execAsync method.
Mitigation. OWASP's entry recommends allowlists for commands, arguments and paths, avoiding shell=True, eval and string-built commands, sandboxing tools with timeouts and read-only filesystems, running as non-root, validating at tool boundaries, and requiring approval for destructive actions.
MCP06: Prompt Injection via Contextual Payloads (Intent Flow Subversion)
What it is. Malicious instructions arrive inside content the agent processes: documents, pages, tickets or tool results. OWASP uses two names for this risk across its pages: Prompt Injection via Contextual Payloads and Intent Flow Subversion. The second names the mechanism. An agent turns the user's request into tool calls using retrieved context, and malicious instructions in that context override the intent in flow, so the agent appears to keep serving the original request.
Real example. The GitHub issue attack above is the standard case.
Mitigation. OWASP's entry recommends anchoring the user's goal and scoring each planned action against it through a policy decision point, having a separate guardrail check proposed tool calls, treating tool outputs as untrusted by default, tagging retrieved content as data, and monitoring for intent drift with human re-authentication. The LLM-level view is in the OWASP Top 10 for LLM Applications.
MCP07: Insufficient Authentication and Authorization
What it is. MCP servers, tools or agents do not verify identities or enforce access controls, which opens critical paths in multi-agent and multi-user setups.
Real example. nginx-ui registered its /mcp_message endpoint without the authentication middleware its /mcp endpoint used. CVE-2026-33032 (CVSS 9.8) affected roughly 2,600 public instances and was reported as exploited from late March 2026.
Mitigation. OWASP's entry recommends mutual TLS, short-lived scoped tokens bound to agent identity, server-side validation of every token, deny-by-default access evaluated per request, and central IAM or OIDC. Never expose an unauthenticated server. The MCP authentication guide covers the flow.
MCP08: Lack of Audit and Telemetry
What it is. Limited telemetry slows investigation and incident response. OWASP calls for detailed logs of tool invocations, context changes and user-agent interactions, kept in immutable audit trails.
Mitigation. OWASP's entry recommends structured, tamper-evident logs in write-once storage, forwarding to a SIEM, OpenTelemetry tracing, behavioral baselines, and retention aligned with compliance requirements.
MCP09: Shadow MCP Servers
What it is. Unapproved or unsupervised MCP deployments run outside formal governance, often with default credentials or permissive settings.
Real example. The CSA note tells teams to inventory every MCP server, including those added through developer tools such as Cursor, Windsurf and Claude Desktop, and to verify patch status.
Mitigation. OWASP's entry recommends central registration that fails CI/CD deployments of unregistered instances, continuous discovery scans for MCP ports and routes such as /mcp, and secure-by-default templates that require authentication. Send all MCP traffic through one controlled path.
MCP10: Context Injection and Over-Sharing
What it is. When working context is shared, persistent or poorly scoped, sensitive information leaks between tasks, users or agents.
Real example. Asana launched its MCP feature on May 1, 2025. A logic flaw let some users see other organizations' data until Asana found it on June 4, and about 1,000 customers were affected, BleepingComputer reported on June 18, 2025.
Mitigation. OWASP's entry recommends ephemeral per-session context with a TTL, separate namespaces per user, agent and tenant, data classification, redaction before storage, and human approval before sensitive context is exported. See what memory and context poisoning looks like for the persistent case.
)
How to Use the List in Your Organization
Use the list as a five-step review: inventory every MCP server, scope what each agent can reach, inspect tool content, record every call and test the result. Run the steps in order, because you cannot scope what you have not found.
| Step | What to do | Risks it addresses |
|---|---|---|
| 1. Inventory | List every server, who owns it, how it authenticates and what data it touches, including servers on developer machines | MCP09, MCP04, MCP07 |
| 2. Scope | Give each agent only its tools, short-lived credentials and per-user identity; pin tool definitions | MCP01, MCP02, MCP03 |
| 3. Inspect | Check tool descriptions and results before the agent acts; require approval for sensitive actions | MCP06, MCP03, MCP05 |
| 4. Record | Log every call and keep the trail | MCP08, MCP10 |
| 5. Test | Attack your own agents with injection and tool misuse before attackers do | All ten |
New to the protocol? Start with what an MCP server is.
How a Gateway and Runtime Layer Cover the List
A gateway and runtime layer covers the risks that travel through AI traffic: identity, tool access, tool descriptions and results, and the record of every call. It cannot fix code inside a server, which is why four of the ten risks stay shared with the customer.
NeuralTrust sits in that path. Agent Gateway (TrustGate) is the single point that calls to models and MCP servers go through, and its registry works as an allowlist: nothing routes anywhere until it exists there, and each MCP server instance can use its own credential, held by the gateway so the agent never receives it. Agent Runtime Security (TrustGuard) inspects content and, depending on the policy, logs, blocks, masks or asks for confirmation. Together they form the Runtime Security Mesh. The table shows our own assessment against the 2025 beta list.
| Risk | What the control layer does | What stays with you | Coverage |
|---|---|---|---|
| MCP01 Token Mismanagement | Gateway holds server credentials, per-user accounts, detects keys in traffic | Nothing specific to MCP traffic | Covered |
| MCP02 Scope Creep | Tools assigned per application, access by person and group | Nothing specific to MCP traffic | Covered |
| MCP03 Tool Poisoning | Inspects tool descriptions and results for hidden instructions, including later changes | Nothing specific to MCP traffic | Covered |
| MCP04 Supply Chain | Registry allows only approved servers; inspects their tool text | Review each server's code, dependencies and publisher; pin versions | Shared |
| MCP05 Command Injection | Detects the injection that precedes execution; limits callable tools | Validate inputs inside each server | Shared |
| MCP06 Prompt Injection via Context | Inspects tool results, links and files; can block the call | Nothing specific to MCP traffic | Covered |
| MCP07 Authentication | Authenticates applications and people before any call | Nothing specific to MCP traffic | Covered |
| MCP08 Audit and Telemetry | Records caller, policy decision, cost and latency for every call | Nothing specific to MCP traffic | Covered |
| MCP09 Shadow Servers | Only registered servers are reachable through the gateway | Block direct MCP connections from devices | Shared |
| MCP10 Over-Sharing | Per-user accounts, masking of personal data | Separate each user's context and memory in the application | Shared |
Read the "Shared" rows as a boundary, not a gap, because server code, direct laptop connections and application memory sit outside AI traffic. More on the gateway side is in AI gateway for agentic AI.
Where to Start
Start with the situation that matches your exposure today, because each starting point closes a different set of risks first. The table maps four common situations to the first control to put in place in your environment and the risks it addresses.
| Your situation | Start here | Risks |
|---|---|---|
| You do not know which MCP servers teams use | Inventory and an approved registry | MCP09, MCP04 |
| Agents share one token across users | Per-user identity and short-lived tokens | MCP01, MCP02, MCP07 |
| Agents read email, tickets or issues | Inspect tool results and require approval for actions | MCP06, MCP03 |
| You build and host your own servers | Input validation, sandboxing and dependency review | MCP05, MCP04 |
Conclusion
The OWASP MCP Top 10 gives security teams a shared vocabulary for the tool layer of agent systems, and the incidents from 2025 and 2026 show these risks are already exploited. Treat it as a beta checklist: inventory servers, scope credentials, inspect tool content, record every call and test. A gateway closes the risks that cross AI traffic, while server code stays your responsibility.
Secure MCP Servers in Production with NeuralTrust
Put one controlled path in front of every MCP server your agents use, with per-user identity, an approved registry and a record of each call. See how Agent Gateway (TrustGate) works at neuraltrust.ai/ai-gateway, or book a demo.
)
Related Reading
- OWASP Top 10 for LLM Applications 2026
- OWASP Top 10 for Agentic Applications 2026
- MCP Authentication: How to Secure MCP Servers
- What Is an MCP Server?
FAQs about OWASP MCP Top 10
1. What is the OWASP MCP Top 10?
The OWASP MCP Top 10 is a community-maintained list of the ten most critical security risks of the Model Context Protocol, from token exposure and tool poisoning to shadow servers. It is the 2025 edition and is in beta, so it is a working checklist that OWASP expects to refine before a final release.
2. What are the ten risks in the OWASP MCP Top 10?
They are MCP01 Token Mismanagement and Secret Exposure, MCP02 Privilege Escalation via Scope Creep, MCP03 Tool Poisoning, MCP04 Software Supply Chain Attacks, MCP05 Command Injection and Execution, MCP06 Prompt Injection via Contextual Payloads, MCP07 Insufficient Authentication and Authorization, MCP08 Lack of Audit and Telemetry, MCP09 Shadow MCP Servers and MCP10 Context Injection and Over-Sharing.
3. Is the OWASP MCP Top 10 final?
No. The project page places it in Phase 3 of five, Beta Release and Pilot Testing, with final release and continuous improvement still ahead. Entries carry a 2025 label, so expect names, ordering or scope to change. Check the project page before citing it in an audit.
4. How is it different from the OWASP Top 10 for LLM Applications?
The LLM list covers risks of applications that use language models, such as prompt injection and unbounded consumption. The MCP list covers the tool connection layer: servers, tokens, tool descriptions and shared context. Many attacks cross both, which is why MCP06 overlaps with LLM prompt injection.
5. What is the difference between Intent Flow Subversion and Prompt Injection via Contextual Payloads?
They are two names for MCP06, and OWASP uses both across its pages. Prompt Injection via Contextual Payloads describes the payload: instructions hidden in content an agent reads. Intent Flow Subversion describes the effect: those instructions override the user's intent inside the agent's plan, so the agent appears to keep doing what was asked.
6. Does MCP require authentication?
No. The MCP specification (2026-07-28 revision) says authorization is optional. HTTP-based implementations should follow the OAuth-based flow when they support it, and STDIO servers should take credentials from the environment. Security therefore depends on how each server is deployed, which is what MCP07 addresses.
7. Can a gateway cover every item on the list?
No. A gateway covers risks that travel through AI traffic, such as identity, tool access, tool descriptions and call records. It cannot validate input inside a server's code, review dependencies, or block connections that bypass it. In NeuralTrust's assessment, six risks are covered and four are shared.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- OWASP Foundation, OWASP MCP Top 10 and GitHub repository, 2025 beta, accessed October 27, 2026.
- Model Context Protocol, Authorization specification, 2026-07-28 revision.
- Cloud Security Alliance, MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure, May 4, 2026.
- Cloud Security Alliance, CVE-2026-33032: Nginx-UI MCP Authentication Bypass, April 16, 2026.
- Tenable, CVE-2026-0755, published January 23, 2026.
- Tenable, CVE-2025-6514, published July 9, 2025.
- The Hacker News, First Malicious MCP Server Found, September 29, 2025.
- BleepingComputer, Asana warns MCP AI feature exposed customer data to other orgs, June 18, 2025.
- DevClass, Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fix, May 27, 2025.
- NeuralTrust Docs, Registry, accessed October 27, 2026.
)
)
)
)