# OWASP MCP Top 10: A Guide to Securing Model Context Protocol in 2026 Last updated: June 24, 2026 | 20 MIN Between January and February 2026, security researchers filed more than 30 CVEs against Model Context Protocol servers, clients, and infrastructure. Palo Alto Networks Unit 42 measured a 78.3 percent attack success rate when five MCP servers were connected to a single AI agent. The OWASP MCP Top 10 is the first OWASP framework dedicated to this new attack surface, and it arrived just in time. This guide walks AppSec, platform, AI engineering, and DevSecOps teams through all ten risk categories. You will get a plain English description of each risk, real CVEs and disclosed attacks mapped to the categories, and a defense playbook layered across the SDLC and the Agentic Development Lifecycle (ADLC). If you are new to the protocol, start with this overview of the Model Context Protocol (MCP) before diving in. ## What Is the OWASP MCP Top 10? The OWASP MCP Top 10 is OWASP’s first dedicated Top 10 project for Model Context Protocol implementations. It catalogs the ten risk categories most likely to compromise an MCP deployment, ranging from token mismanagement and tool poisoning to shadow MCP servers and context over sharing. The MCP Top 10 sits alongside two related OWASP projects: the Top 10 for LLM Applications and the Top 10 for Agentic AI. The LLM list focuses on model-level risks like prompt injection and training data poisoning. The Agentic AI list addresses risks that emerge from autonomous agent behavior. The MCP list is narrower and more protocol-specific. It targets the tool discovery, context passing, and tool invocation layer between an AI agent and external systems, which makes it directly relevant to anyone deploying MCP servers in production. ## Why the OWASP MCP Top 10 Matters for AI Driven Development? MCP has become the default connector between AI agents and enterprise systems, but adoption has outpaced security by a wide margin. Cycode’s 2026 State of Product Security report found that 81 percent of organizations lack full visibility into how AI is used across the SDLC, while 65 percent report increased security risk from AI tooling. MCP servers sit at the intersection of those two problems. ### MCP Has Exploded Across the Developer Stack MCP adoption has moved quickly across developer tools, AI coding assistants, IDE extensions, and agent workflows. What started as a protocol for connecting AI systems to external tools is now becoming a common integration layer across the software development stack. That growth creates two practical problems. The ecosystem is dominated by individual developers and small teams shipping connectors without formal security review, and the dependency graph is enormous. A single AI coding tool might connect to ten MCP servers, each pulling in its own packages and credentials. Every new server is a new trust boundary that your existing AppSec controls likely cannot see. - Thousands of public MCP servers now exist across GitHub, spanning GitHub, Slack, Jira, databases, cloud, and CI/CD tools. - New MCP servers are published weekly, often without clear ownership, review, or maintenance. - Anthropic, OpenAI, Microsoft, and every major IDE now ship MCP support by default. ### MCP Expands the Trust Boundary Beyond Traditional AppSec Traditional AppSec assumes code is the source of risk. MCP breaks that assumption in three places. Tool descriptions, retrieved documents, and tool outputs all enter the agent’s context window as trusted text. The agent treats them as instructions worth following, even when they come from an attacker-controlled GitHub issue or a poisoned tool metadata field. Every connected MCP server becomes a fresh trust boundary, and one compromised server can hijack an agent across the whole pipeline. That makes securing MCP a governance problem as much as a coding problem, spanning the Agentic Development Lifecycle (ADLC) from IDE to CLI to CI/CD to production. ### MCP Vulnerabilities Are Already Mass Scale, Not Theoretical The numbers tell the story plainly. Researchers filed 30 plus CVEs in 60 days in early 2026. CVE-2025-6514 in mcp-remote hit a CVSS score of 9.6 and affected a package downloaded more than 437,000 times before disclosure. These are not exotic AI native attacks but classic web application vulnerabilities wearing new uniforms, and they are exploitable today. Many MCP servers handle files, execute commands, call APIs, and manage credentials, which makes path traversal, command injection, insecure auth, and over-permissioned access immediate concerns. ### Existing AppSec Tools Miss MCP Risk by Default Traditional SAST and SCA were built for source code, not for tool descriptions. A clean source code scan will completely miss a tool poisoning attack, because the malicious content lives in metadata fields that the scanner has no reason to read. Shadow MCP servers bypass centralized security policies because no one knew they existed in the first place. Classic application security tools also do not see the runtime interactions between an agent and the MCP servers it talks to. The result is a visibility gap that compounds with every new MCP server added to the environment. ### Regulatory and Compliance Pressure Is Rising Compliance is catching up to the technology fast. The NIST AI Agent Standards Initiative kicked off in February 2026, and the EU AI Act, ISO 42001, SOC 2, DORA, and PCI-DSS all increasingly touch agent behavior and credential handling. Auditors are starting to ask for evidence of agent activity logs, credential rotation, and tool inventory. The AI Bill of Materials (AIBOM) is emerging as the new SBOM analog for AI components, with MCP servers as one of its core inputs. Teams without an AIBOM today will be answering uncomfortable questions in the next audit cycle. ## The OWASP MCP Top 10 Risks Explained Below is a category by category walkthrough of the OWASP MCP Top 10, version 0.1 (2025). For each risk, we cover what it is, a real-world example or CVE with the source, and the most effective primary mitigation. | ID | Risk | Primary Defense | | --- | --- | --- | | MCP01 | Token Mismanagement and Secret Exposure | Short-lived, scoped tokens; secrets detection | | MCP02 | Privilege Escalation via Scope Creep | Least privilege scopes; automated scope expiry | | MCP03 | Tool Poisoning | Signed, pinned tools; description scanning | | MCP04 | Supply Chain Attacks and Dependency Tampering | Signed components; AIBOM and provenance | | MCP05 | Command Injection and Execution | Input validation; sandboxed execution | | MCP06 | Intent Flow Subversion (Prompt Injection) | Context isolation; instruction quarantine | | MCP07 | Insufficient Authentication and Authorization | OAuth 2.1 plus MFA; per server audience validation | | MCP08 | Lack of Audit and Telemetry | Immutable audit logs; behavioral monitoring | | MCP09 | Shadow MCP Servers | Continuous discovery; allowlist enforcement | | MCP10 | Context Injection and Over Sharing | Scoped context windows; ephemeral memory | ### MCP01:2025 Token Mismanagement and Secret Exposure Hard-coded API keys, long-lived tokens, and secrets stored in model memory or protocol logs expose connected systems to unauthorized access. Attackers retrieve these tokens through prompt injection, compromised context, or debug traces, then pivot into the systems the tokens authenticate to. A typical scenario plays out like this: a developer commits an API key during testing, the MCP server reads it from a config file at startup, and the AI assistant later surfaces it in a response. Mitigation requires short-lived scoped tokens, continuous secrets detection, and AI Guardrails that intercept outbound prompts before secrets leak. ### MCP02:2025 Privilege Escalation via Scope Creep Temporary or loosely defined permissions inside MCP servers tend to expand over time, granting agents excessive capabilities. An attacker exploiting weak scope enforcement can perform actions far beyond what the user intended, such as repository modification, system control, or cross-tenant data access. This risk is especially dangerous in GitHub connected MCP workflows. A prompt injection hidden inside a public issue can redirect an agent that has access to both public and private repositories, causing private code or secrets to be pulled into context and exposed through a public pull request or comment. The failure is not just prompt injection. It is excessive access across trust boundaries without runtime policy enforcement to stop data movement between sensitive and public environments. ### MCP03:2025 Tool Poisoning Tool poisoning is when an adversary compromises the tools, plugins, or outputs that an AI model relies on. The sub-techniques include rug pulls (a tool updates its description after install), schema poisoning (corrupting the interface definition), and tool shadowing (a fake tool intercepts calls meant for a legitimate one). ### MCP04:2025 Software Supply Chain Attacks and Dependency Tampering MCP ecosystems depend on open-source packages, connectors, and model-side plugins, each of which can contain malicious or vulnerable components. A single compromised dependency can alter agent behavior or introduce execution-level backdoors across every deployment that pulled the bad version. ### MCP05:2025 Command Injection and Execution Command injection occurs when an AI agent constructs and executes system commands, shell scripts, API calls, or code snippets using untrusted input. The input could come from a user prompt, retrieved context, or a third-party data source, and the agent rarely validates it before passing it to a shell or eval-style API. ### MCP06:2025 Intent Flow Subversion (Prompt Injection via Context) The Model Context Protocol enables agents to retrieve complex context that can act as a secondary instruction channel. Intent Flow Subversion happens when malicious instructions embedded in retrieved context hijack the agent’s reasoning, steering it away from the user’s original goal toward an attacker’s objective. ### MCP07:2025 Insufficient Authentication and Authorization Inadequate authentication and authorization arise when MCP servers, tools, or agents fail to properly verify identities or enforce access controls during interactions. Because MCP ecosystems involve multiple agents, users, and services exchanging data and executing actions, even small identity gaps create critical attack paths. ### MCP08:2025 Lack of Audit and Telemetry Limited telemetry from MCP servers and agents makes investigation and incident response nearly impossible. Without comprehensive logs of tool invocations, context changes, and user-agent interactions, security teams cannot tell what an agent did, when it did it, or whether a prompt injection ever fired. ### MCP09:2025 Shadow MCP Servers Shadow MCP Servers are unapproved or unsupervised MCP deployments that operate outside formal security governance, much like shadow AI and shadow IT. Developers, research teams, and data scientists spin them up for experimentation or convenience, then leave them running with default credentials, permissive configurations, and unsecured APIs. ### MCP10:2025 Context Injection and Over Sharing In MCP, “context” is the working memory that stores prompts, retrieved data, and intermediate outputs across agents or sessions. When context windows are shared, persistent, or insufficiently scoped, sensitive information from one task, user, or agent can be exposed to another. Convenience becomes a liability. ## How to Mitigate the OWASP MCP Top 10 No single control closes the entire OWASP MCP Top 10. Effective defense layers identity, supply chain, runtime, and governance controls across the Agentic Development Lifecycle. The sections below group the controls by where they live in the SDLC and ADLC. ### Govern Identity, Tokens, and Scopes Before Anything Else This control set covers MCP01, MCP02, and MCP07, which together account for most of the worst MCP incidents to date. The static API key problem is the foundation. Replace static keys with short-lived OAuth 2.1 tokens, validate audience per server, enforce automatic scope expiry, and require MFA for human approvers of high-risk actions. ### Treat Tool Descriptions and Retrieved Context as Untrusted Input This control set covers MCP03, MCP06, and MCP10. The mental model is simple: anything the agent reads is potentially adversarial. Tool descriptions, retrieved documents, web pages, GitHub issues, CRM entries, even commit messages can carry hidden instructions. ### Secure the MCP Supply Chain End to End This control set covers MCP04. The mcp-remote and Postmark incidents show what happens when supply chain hygiene lags behind ecosystem growth. Demand provenance for every connector and dependency, maintain an AI Bill of Materials (AIBOM) across the ADLC, and monitor CVE feeds for MCP packages. ### Sandbox Execution and Validate Every Tool Input This control set covers MCP05, the single most common bug class in disclosed MCP CVEs. Wrap every shell, file, and network call in a parameterized API. Deny by default network egress for local MCP servers so that even a successful command injection cannot reach the internet. Run MCP servers inside containerized sandboxes wherever possible. ### Get Visibility: Discover, Inventory, and Log Every MCP Server This control set covers MCP08 and MCP09, the meta risks that hide every other risk. You cannot defend what you cannot see. Run continuous discovery of MCP servers, AI assistants, models, and rule files across repos and developer machines, then feed everything into immutable audit logs and behavioral monitoring. ### Apply Controls at the Developer Edge: IDE, CLI, and PR This is the cross-cutting control that ties the rest together. The IDE and CLI are now security boundaries. Intercept prompts, file reads, and MCP tool calls before sensitive data ever leaves the developer machine. ## How Cycode Helps You Address the OWASP MCP Top 10 Cycode is an Agentic Development Security Platform purpose-built for AI-driven development, with native controls across every layer the OWASP MCP Top 10 covers.