OWASP MCP Top 10 Explained
The top security risks that become acute when agents use tools through protocols like MCP. Based on OWASP AI Agent Security guidance and real-world attack patterns.
This list maps general AI agent risks to the MCP-specific context. Each entry includes what the risk looks like, why it matters, and the control that reduces it. Use it alongside the MCP Security Checklist to structure your review.
Tool Poisoning
A malicious or compromised MCP server returns instructions, prompts, or data designed to manipulate the calling agent or leak context.
Control: Whitelist trusted servers, inspect responses, and run servers in sandboxed environments.
Confused Deputy
An application or agent uses permissions granted to another application to perform actions the user did not authorize.
Control: Bind tokens and sessions to specific callers and enforce per-client authorization.
Prompt Injection via Tool Output
Tool responses contain embedded instructions that override the system prompt or change agent behavior.
Control: Sanitize and filter tool responses before adding them to the LLM context.
Excessive Permissions
An MCP server or tool requests broader access than its function requires, increasing blast radius.
Control: Apply least privilege at the tool and argument level; review scopes during onboarding and updates.
Credential Exposure
Tokens, API keys, or credentials are stored in plaintext configs, logs, or clipboard history.
Control: Use secrets managers, avoid logging sensitive values, and rotate credentials regularly.
Insecure Server Supply Chain
Third-party MCP servers are installed without source review, publisher verification, or update tracking.
Control: Maintain an inventory, verify publishers, and review changes before updating servers.
Insufficient Logging
Organizations cannot reconstruct which tools were called, by whom, and with what arguments.
Control: Log every tool call with caller identity, arguments, and outcome; ship logs to a SIEM.
Lack of Runtime Isolation
MCP servers run with full user or system privileges and unrestricted network access.
Control: Run servers in containers or sandboxes with restricted filesystem and network egress.
Missing User Consent
High-risk actions are executed without explicit user approval because the LLM interpreted intent loosely.
Control: Require explicit confirmation for destructive, expensive, or outbound actions.
Insecure Defaults
Clients or servers ship with overly permissive defaults, such as auto-approving all tools or exposing localhost services.
Control: Change defaults to deny-by-default and require explicit opt-in for each server and tool.
Get the actionable checklist
Turn these risks into concrete controls you can review before production.
Read the checklist