OWASP MCP Top 10: What MCP01–MCP10 Actually Say

The OWASP MCP Top 10 (MCP01 through MCP10) catalogues the most critical security risks in systems built on the Model Context Protocol. MCP is the emerging framework for defining the operational, contextual, and behavioural boundaries of AI models, and the protocol's power and flexibility brought a new class of attack surface with it. The OWASP project exists to map that surface and give AI developers, ML engineers, and security practitioners something concrete to design and audit against.

Here is what each of the ten entries covers, how they group, and what to do about them. The source is the OWASP MCP Top 10 project page.

The ten risks at a glance

One thing to know before you cite it

The MCP Top 10 is currently at Phase 3, beta release and pilot testing. The project roadmap describes it as a living document, with continuous improvement and the next release expected in October 2026. That matters for how you use it: it is solid enough to structure a threat model and a review checklist around today, but entry numbering and wording may still move. Cite it as guidance, not as a frozen standard.

Identity and access: MCP01, MCP02, MCP07

Three of the ten entries are, at root, the same failure: the protocol hands out more authority than anyone intended and then fails to check who is using it.

MCP01, Token Mismanagement and Secret Exposure, covers hard-coded credentials, long-lived tokens, and secrets that end up sitting in model memory or protocol logs. The retrieval paths are the interesting part: an attacker can pull those tokens back out through prompt injection, a compromised context window, or debug traces. A secret that never appears in source code can still leak through a trace.

MCP02, Privilege Escalation via Scope Creep, is the slow version of the same problem. Permissions granted temporarily or defined loosely tend to widen over time until an agent can modify repositories, control systems, or move data well beyond its original remit.

MCP07, Insufficient Authentication and Authorization, is what makes the first two exploitable at scale. MCP ecosystems involve multiple agents, users, and services exchanging data and triggering actions; where identity validation is weak or absent, every one of those exchanges is a candidate attack path.

The instruction channel: MCP03, MCP06, MCP10

This is the cluster that has no real analogue in traditional application security, and it is where MCP risk is genuinely novel.

MCP03, Tool Poisoning, is compromise of the tools or plugins a model depends on, or of their outputs, to inject misleading or malicious context and steer the model's behaviour.

MCP06, Intent Flow Subversion, names the underlying mechanic precisely. Because MCP lets agents retrieve rich context, that context effectively becomes a second instruction channel. Malicious instructions embedded in retrieved content hijack the intent flow, steering the agent from the user's goal toward the attacker's. The user asked for one thing; the context told the agent to do another.

MCP10, Context Injection and Over-Sharing, is the data-exposure side. Context is working memory: prompts, retrieved data, intermediate outputs, held across agents and sessions. When those windows are shared, persistent, or loosely scoped, information from one task, user, or agent bleeds into another. The convenience of a shared context is exactly what turns it into a liability.

Execution and supply chain: MCP04, MCP05

MCP05, Command Injection and Execution, is the classic vulnerability with a new entry point. An agent constructs and runs shell commands, API calls, or code from untrusted input, and the untrusted input now includes user prompts, retrieved context, and third-party data sources. Validation has to cover all three, not just the prompt.

MCP04, Software Supply Chain Attacks and Dependency Tampering, is short in the source and blunt: a compromised dependency can change agent behaviour or plant execution-level backdoors. This is the entry that connects the MCP list to the rest of supply chain security, and to the sibling framework covered below.

Operations: MCP08, MCP09

MCP09, Shadow MCP Servers, is the one most likely to be true in your environment right now. These are unapproved MCP deployments running outside formal governance, spun up by developers, research teams, or data scientists for experimentation or convenience, and typically carrying default credentials, permissive configuration, and unsecured APIs. It is Shadow IT with a credentialed agent attached.

MCP08, Lack of Audit and Telemetry, is what guarantees you cannot investigate any of the above. Thin telemetry from MCP servers and agents makes incident response guesswork. The prescribed control is detailed, immutable logging of tool invocations, context changes, and user-agent interactions.

How this relates to the Agentic Skills Top 10

OWASP published a separate Agentic Skills Top 10 in August 2026, and the two are complements rather than competitors. MCP servers are separate processes exposing tools over a protocol; skills are bundles of instructions, code, and resources an agent loads into its context. The lists cross-reference each other.

Read together, they describe the same underlying shift from two directions. MCP06 (intent flow subversion) and MCP10 (context over-sharing) are the protocol-side statement of the thesis running through the skills framework: the instruction layer is attack surface. A control that only inspects code is reading half the artifact, whether that artifact is a SKILL.md file or a tool description served over MCP. We have written about why static analysis alone cannot catch this class of problem, and about MCP server impersonation specifically.

Where to start

If you run MCP servers today, the sequence that closes the most exposure fastest:

1. Find the shadow servers first (MCP09). You cannot govern deployments you do not know about, and the unsanctioned ones carry the weakest configuration by definition.
2. Audit token handling (MCP01). Rotate long-lived credentials, get secrets out of context and logs, and check what your debug traces actually capture.
3. Re-scope permissions (MCP02, MCP07). Enforce least privilege per tool, and verify identity on every agent-to-service exchange rather than trusting the session.
4. Turn on telemetry (MCP08) before you need it: immutable logs of tool invocations and context changes.
5. Treat retrieved context as untrusted input (MCP06, MCP10), the same way you already treat user input, and scope context windows per task rather than sharing them.

FAQ

What is the OWASP MCP Top 10? It is an OWASP project cataloguing the ten most critical security risks in systems built on the Model Context Protocol, numbered MCP01 through MCP10. It covers risks across the MCP lifecycle, from token handling and privilege scope to tool poisoning, context over-sharing, and unsanctioned server deployments.

Is the MCP Top 10 final? Not yet. The project is at Phase 3, beta release and pilot testing, and is described as a living document with the next release expected in October 2026. Use it to structure reviews, but expect refinement.

How is it different from the OWASP Top 10 for LLM Applications? The LLM Top 10 addresses risks in LLM-backed applications generally. The MCP list is specific to the protocol layer: the servers, tools, context, and permissions that MCP introduces between a model and the systems it acts on.

Does it overlap with the Agentic Skills Top 10? Deliberately, at the edges. Supply chain compromise and instruction-layer manipulation appear in both, because a malicious skill and a poisoned MCP tool can achieve the same outcome by different routes. The MCP list governs the protocol and its servers; the skills list governs the artifacts an agent loads.

Where can I read the original? The OWASP MCP Top 10 project page carries the current entries, descriptions, and roadmap.