Guide to the OWASP MCP Top 10

The Model Context Protocol (MCP) has become the most popular agentic protocol, with over 10,000 active servers and 97 million monthly SDK downloads. However, this widespread adoption introduces significant cybersecurity concerns, as many teams overlook agents as potential system vulnerabilities. OWASP recently released a working draft of its MCP Top 10, a security framework detailing common vulnerabilities across MCP servers, tools, clients, and agentic workflows. This guide provides a deep dive into these emerging threats and offers best practices to safeguard your MCP ecosystem.

One critical vulnerability is leaked credentials, exacerbated by MCP's uniquely long-lived sessions. A compromised token or API key can severely damage a system, especially if hard-coded or if models retain conversational history. To mitigate this, store secrets in secure vaults, use environment variable injection at runtime, and implement just-in-time privileges with short-lived, narrowly scoped tokens.

Privilege escalation, where an agent’s capabilities expand beyond its initial design, presents another significant risk. Overly simplified read/write permissions, often implemented for ease of development, can be exploited. Strict, fine-grained role-based access control (RBAC) and regular privilege reviews are essential to prevent malicious access to admin-level resources.

Tool poisoning occurs when cybercriminals manipulate an MCP tool's metadata, causing LLMs to execute malicious commands. Treating all tool descriptions and output as untrusted input, employing runtime inspection proxies, and cryptographically signing tool manifests can prevent such attacks.

Supply chain attacks and dependency tampering, involving compromised third-party libraries, pose risks due to package managers often lacking signature verification. Hard-coding dependencies to verified versions, requiring signature verification for all packages, and maintaining a private registry can protect against malicious code injection.

Command execution vulnerability allows attackers to gain full system privileges when MCP servers process raw data. To prevent this, never allow MCP servers to execute raw code, rigorously inspect inputs, and run MCP tools in sandboxed or containerized environments. Intent flow subversion, where harmful instructions are embedded in an agent's context to bypass security and exfiltrate data, necessitates careful security protocols, especially in multi-step agentic flows.