International · Risk taxonomy
OWASP MCP Top 10: governing agent tools and MCP servers
The OWASP MCP Top 10 lists the most critical security risks in systems built on the Model Context Protocol, the open protocol that connects AI agents to tools and data. The project is in phase 3, beta release and pilot testing, with entries labelled MCP01:2025 to MCP10:2025, and OWASP expects the list to keep changing. Any agent that reaches tools through MCP servers carries these risks.
In the FairMind catalogue: 10 requirements mapped to 32 workflows and 16 evaluations.
Source: OWASP MCP Top 10 project
OWASP MCP Top 10: what it asks of AI systems
The parts most relevant to governing AI systems and agents, summarised from the OWASP MCP Top 10 (2025, beta).
- MCP01Token mismanagement and secret exposure
- Hard-coded credentials, long-lived tokens, or secrets left in model memory and logs.Mapped to: Agent identity, access and permission bounding
- MCP02Privilege escalation via scope creep
- Permissions granted to an MCP server or agent widen over time beyond what tasks need.Mapped to: Agent identity, access and permission bounding
- MCP03Tool poisoning
- Malicious instructions hidden in tool descriptions or metadata steer the agent.Mapped to: Agent identity, access and permission bounding, Threat modelling, guardrails and vulnerabilities
- MCP04Supply chain attacks and dependency tampering
- Compromised MCP servers, packages or dependencies enter the agent's toolchain.Mapped to: AI inventory and intake, Agent identity, access and permission bounding
- MCP05Command injection and execution
- Agent input reaches system commands or interpreters through MCP tools without validation.Mapped to: Agent identity, access and permission bounding, Responsible design and secure development
- MCP06Prompt injection via contextual payloads
- Instructions embedded in content an MCP tool returns take over the agent.Mapped to: Threat modelling, guardrails and vulnerabilities
- MCP07Insufficient authentication and authorisation
- MCP servers and clients that do not verify who is calling and what they may do.Mapped to: Agent identity, access and permission bounding
- MCP08Lack of audit and telemetry
- Missing logs and telemetry leave MCP tool calls untraceable during an incident.Mapped to: Agent identity, access and permission bounding, Monitoring and logging
- MCP09Shadow MCP servers
- MCP servers deployed outside governance, unknown to the security team.Mapped to: AI inventory and intake
- MCP10Context injection and over-sharing
- Sensitive context shared with tools or models that should not see it.Mapped to: Data governance and provenance
Evidence FairMind helps you produce
FairMind links technical evidence to OWASP MCP Top 10 obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- MCP server and tool onboarding records, approved at the gate
- 16 evaluations mapped to MCP01 to MCP10, including MCP server permission audit, shadow MCP servers and MCP authentication
- Agent activity log monitoring that ties each tool call to an agent identity
- Periodic access reviews that catch scope creep
OWASP MCP Top 10 questions
What is the Model Context Protocol?
An open protocol, introduced by Anthropic in November 2024, that standardises how AI applications connect to external tools and data sources. An MCP server exposes tools; an agent calls them. That makes MCP servers part of the attack surface of every agent that uses them.
Is the OWASP MCP Top 10 final?
No. It is a beta release in pilot testing, so names and order may change. FairMind maps the current IDs and records the version, so evidence stays traceable when the list changes.
How does FairMind map the MCP Top 10?
The catalogue maps all 10 entries to 6 common controls and 32 workflows, centred on agent identity, access and permission bounding. Every workflow stops at a human approval gate before anything is recorded.