OWASP MCP Top 10 Crosswalk
Purpose: Let a team that uses the OWASP MCP Top 10 find the matching risks and controls in this wiki for agents that connect to tools and data through the Model Context Protocol.
Audience: AI platform engineers, application security, security architecture, red teams.
Using the two together: Use the OWASP list to name MCP risks. Use this wiki for controls, evidence, tests, and the Agent Architecture Patterns that contain them.
About the list and this page
The OWASP MCP Top 10 is an OWASP project on the security of the Model Context Protocol. The identifiers and titles below were read from the project page on 17 October 2026, which describes the list as a beta in pilot testing. Titles may change before a final release, so check the project page before citing an item. This page cites identifiers and titles only. The mapping is this wiki's judgement and has not been reviewed by OWASP.
The wiki's other OWASP lists, for LLM applications and for agentic applications, are in the OWASP Top 10 Crosswalk.
Match is Direct when the wiki has a risk and controls for the item, and Partial when it covers only part, as the last column explains.
MCP Top 10 to wiki risks and controls
| ID | Title | Wiki risks | Main wiki controls | Match | Notes |
|---|---|---|---|---|---|
MCP01:2025 |
Token Mismanagement & Secret Exposure | AI-R22 | AI-CTRL-015, AI-CTRL-016 | Direct | Short-lived scoped tokens issued at call time; no secrets in configuration files or in the model's context. |
MCP02:2025 |
Privilege Escalation via Scope Creep | AI-R07, AI-R23 | AI-CTRL-016, AI-CTRL-024 | Direct | Least-privilege scopes, periodic review of granted scopes, and step-up authorization for sensitive tools. |
MCP03:2025 |
Tool Poisoning | AI-R23, AI-R24 | AI-CTRL-024, AI-CTRL-026 | Direct | Review tool descriptions before approval, pin their hashes and alert on change (Builder Track B4). |
MCP04:2025 |
Software Supply Chain Attacks & Dependency Tampering | AI-R23, AI-R08 | AI-CTRL-024, AI-CTRL-031 | Direct | Allow-listed sources, version pinning and review of updates. See the postmark-mcp case. |
MCP05:2025 |
Command Injection & Execution | AI-R24, AI-R23 | AI-CTRL-020, AI-CTRL-027 | Direct | Validate tool inputs, never build shell strings, and run servers sandboxed. See the mcp-remote case. |
MCP06:2025 |
Prompt Injection via Contextual Payloads | AI-R05, AI-R24 | AI-CTRL-005, AI-CTRL-022 | Direct | Treat tool output as untrusted and break the lethal trifecta. See the GitHub MCP case. |
MCP07:2025 |
Insufficient Authentication & Authorization | AI-R07, AI-R46 | AI-CTRL-015, AI-CTRL-016 | Direct | OAuth with audience-bound tokens and no token passthrough; per-tool authorization. |
MCP08:2025 |
Lack of Audit and Telemetry | AI-R09, AI-R45 | AI-CTRL-008, AI-CTRL-009 | Direct | Log every call with arguments, result and the agent and user identity. |
MCP09:2025 |
Shadow MCP Servers | AI-R02, AI-R23 | AI-CTRL-001, AI-CTRL-024 | Partial | AI discovery and tool governance apply, but no control or test case names MCP servers on developer machines specifically. |
MCP10:2025 |
Context Injection & Over-Sharing | AI-R06, AI-R21 | AI-CTRL-018, AI-CTRL-026 | Partial | Retrieval access control and memory isolation cover part of it. Isolation of shared context between sessions and tenants is not tested separately. |
Of the ten items, 8 are a direct match and 2 are partial.
Incidents
The AI Security Incident Casebook has four MCP cases: the GitHub MCP toxic agent flow, postmark-mcp, mcp-remote and MCP Inspector.
Attribution
The OWASP MCP Top 10 is published by the OWASP Foundation. This page cites item identifiers and titles only. Check the project's licence before reusing its text.