OWASP MCP Top 10 Assess

mcp security governance owasp ai-security threat-modeling agentic-ai tool-poisoning security-baseline ai-governance

Sep 2026

Overview

The OWASP MCP Top 10 is OWASP's first dedicated Top 10 project for Model Context Protocol implementations. Where the Top 10 for LLM Applications addresses model-level risks and the Top 10 for Agentic Applications addresses autonomous agent behaviour, this list targets the connective tissue: the protocol layer that wires assistants to real systems and data. Its stated scope spans model misbinding, context spoofing, prompt-state manipulation, insecure memory references and covert channel abuse, with risks catalogued as MCP01:2025 through MCP10:2025 and explicitly amplified in agentic, model-chaining and multi-modal orchestration scenarios (project page, Imperva).

The timing is the argument for tracking it separately. MCP moved from a protocol most security teams had barely heard of to the default integration layer for AI agents in under eighteen months, and adoption outpaced hardening (PipeLab, Cycode). Existing AppSec checklists assume a human or deterministic caller; MCP servers break that assumption, because the caller is an LLM generating its arguments by inference over a context window (SkillAudit). A dedicated taxonomy is the minimum shared vocabulary needed to have that conversation.

We place it in assess because it is credible and already being cited as a canonical framework, but it is still in beta and pilot testing, published as a living document, and we have not seen evidence of production programmes whose controls are governed by it end to end. Read it, map it, pilot it against your own MCP inventory — do not yet wire audit or procurement gates to its category numbering.

Adoption Signals

OWASP positions it as its first dedicated Top 10 project for MCP, sitting alongside the Top 10 for LLM Applications and the Top 10 for Agentic AI (Cycode).
It has a named project lead (Vandana Verma Sehgal) and a documented road map, and is tracked as a documentation project in OWASP Nest (DEV Community, OWASP Nest).
Government guidance is being mapped onto it: NSA MCP guidance, which treats the agentic setup as a connected system rather than separate endpoints, has been mapped to the MCP Top 10 with corresponding test approaches (Equixly).
Tool vendors and researchers use it as a scoring baseline: Stacklok compared ToolHive coverage against the list (nhimg), CheckMCP audited 271 servers against it (CheckMCP), and SkillAudit mapped findings from 101 servers to its categories (SkillAudit).
Practitioner explainers and guides are proliferating quickly, each walking all ten categories for security teams (agen.co, Practical DevSecOps, Medium).
The underlying incident record it indexes is real: over 30 CVEs filed against MCP servers, clients and tooling in January–February 2026 alone, 43% of them shell injections (Practical DevSecOps); at least seven indexed CVEs against named MCP components including a CVSS 9.6 in mcp-remote (MCP.Directory); and CVE-2026-32211, an unauthenticated critical function in Microsoft's hosted MCP service (obot.ai).

Risks

Beta status and a moving target. The list is in beta (Phase 3, beta release and pilot testing) and explicitly a living document that will keep changing with protocol innovation, so control mappings pinned to specific MCP0x identifiers may need rework (Imperva, project page).
No enforcement path. OWASP maps the risk; the MCP spec refuses to enforce any of it by design, leaving inventory, identity lineage, per-call authorization and audit trails for the enterprise to build (obot.ai).
Imperfect fit to MCP servers. Researchers who tried to map every finding across 101 servers reported the exercise was instructive mainly because of where OWASP breaks down against MCP's structural differences (SkillAudit).
Tooling gaps at the model layer. No single tool category covers the whole list, and items such as intent flow subversion still need model-layer controls that runtime enforcement alone cannot provide (PipeLab, nhimg).
The list alone does not answer the audit question. A CISO needs evidence that a deployment has been tested against known vulnerability categories, and a taxonomy without a test and reporting harness does not produce that evidence (x.com).
Scale of unmanaged exposure outruns the checklist. OX Security's April 2026 disclosure cited 150M+ downloads, 7,000+ exposed servers and up to 200,000 vulnerable instances, and audits found neglect — dead maintenance and outdated protocol versions — rather than exotic exploits as the dominant weakness (MCP.Directory, CheckMCP).

Pros & Cons

Advantages

It gives model-tool integrations a dedicated, named risk taxonomy (MCP01:2025 through MCP10:2025) covering MCP-specific failure modes such as model misbinding, context spoofing, token mismanagement, tool poisoning, context oversharing and shadow MCP servers, rather than forcing teams to stretch web or API checklists to fit.
It slots cleanly into the existing OWASP AI stack alongside the Top 10 for LLM Applications and the Top 10 for Agentic Applications, so an organisation can cover model-layer, agent-layer and connector-layer risk with one shared vocabulary.
Third parties are already using it as a comparison and testing baseline — NSA MCP guidance has been mapped onto it, Stacklok has compared ToolHive coverage against it, and audits of 271 and 101 MCP servers respectively have been scored against its categories.

Disadvantages

The project is still in beta (described as Phase 3, beta release and pilot testing), and is published as a living document under a CC BY-NC-SA 4.0 licence, so category numbering and wording can still move under any control mapping you build on it.
It is an awareness and documentation artefact, not an enforcement mechanism: the MCP specification does not enforce any of it by design, and reporting notes that no single tool category covers the whole list, leaving the control layer entirely to the adopting organisation.
Independent scanning work found the OWASP mapping does not fit MCP servers cleanly, and coverage analyses note that some items such as intent flow subversion still require model-layer controls that current runtime tooling cannot supply.

Recommendation

Assess it now, deliberately. Have your AI platform and security teams read the ten categories and run a single scoped mapping exercise against one real MCP deployment: which category does each existing control address, which layer enforces it, and where is there nothing at all. Expect the mapping to be imperfect — plan for the categories that do not fit cleanly and for the model-layer items such as intent flow subversion that runtime tooling cannot close on its own. Treat the output as a gap register, not a compliance report.

Pair the taxonomy with the two things it does not give you. First, inventory: shadow MCP servers — unapproved deployments operating outside formal governance — are one of the named risks, and you cannot assess what you have not enumerated. Second, enforcement: because the protocol enforces nothing by design, the practical programme is identity lineage from human to tool, authorization checked at every call, and an audit trail that can reconstruct what happened. Existing NSA-derived guidance already has a published mapping onto this list, which is a reasonable starting point for building concrete tests.

Do not yet make MCP Top 10 coverage a contractual or gate condition while the document is in beta and licensed as CC BY-NC-SA 4.0 material that continues to evolve. Revisit at the next radar cycle: promotion to trial should hinge on a stable non-beta release plus evidence of teams running repeatable tests and producing coverage evidence against the categories, not just citing them in blog posts.