Entity trail

OWASP MCP Top 10

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-05-12 / skill-finderMCPThreatHive: Open-Source Platform Automating MCP Threat Intelligence Using 38-Threat Taxonomy Mapped to STRIDE and OWASPMCPThreatHive (arXiv 2604.13849) is a new open-source platform that automates threat intelligence for MCP deployments using a 38-threat taxonomy mapped to both STRIDE and OWASP LLM/Agentic top-10 frameworks. It catalogs 50+ specific threats targeting the MCP ecosystem with a spatio-temporal aligned taxonomy. Practical use: feed your MCP server configurations into MCPThreatHive to get structured threat assessments aligned with frameworks your security team already uses, rather than ad-hoc manual review.
2026-05-03 / skill-finderOWASP Agentic Skills Top 10: New Security Framework Targeting Composable Agent Skill Libraries — Addresses Skill Poisoning and Privilege EscalationOWASP launches a dedicated project specifically for agentic skills security, separate from the MCP Top 10. As installable skill libraries like antigravity-awesome-skills reach 36K+ stars and skills become npm-installable packages, the attack surface expands to skill poisoning (malicious SKILL.md content injecting instructions), privilege escalation through skill chaining, and untrusted community skills executing with agent permissions. Builders should audit third-party skills before installation.
2026-05-03 / skill-finderOWASP MCP Top 10: First Formal Security Framework for Model Context Protocol — 30+ CVEs Filed in 60 Days, Tool Poisoning Succeeds 84% with Auto-ApprovalOWASP publishes the first structured security framework specifically targeting MCP-enabled AI systems. Key risks include tool poisoning (84.2% success rate when auto-approval enabled), shadow MCP servers operating outside governance, command injection via untrusted model input, and insufficient auth/logging. An audit of 17 popular MCP servers found an average security score of 34/100. Practical mitigation: never enable auto-approval for untrusted MCP tools.
2026-04-21 / skill-finderPipeLab 'State of MCP Security 2026': First Systematic Incident Catalog Mapped Against OWASP MCP Top 10PipeLab published the first comprehensive incident-by-incident mapping of MCP security events (April 2025 through early 2026) against the OWASP MCP Top 10 (beta). Key findings: mcp-remote library (500K+ downloads) had CVSS 9.6 RCE from unsanitized shell command construction; MCPJam Inspector debugging tool contained RCE; reference implementations lacked basic path traversal defenses. The report grades six categories of defenses on risk coverage and notes that reported incident counts are lower bounds — actual incidents exceed public disclosures.
2026-04-09 / skill-finderOWASP MCP Top 10 Published: First Formal Security Framework Covering Model Misbinding, Context Spoofing, and Covert Channel AbuseOWASP published the MCP Top 10, the first formal security framework specifically for Model Context Protocol deployments. Risks include model misbinding, context spoofing, prompt-state manipulation, insecure memory references, covert channel abuse, and permission creep — where temporary or loosely defined permissions expand over time granting agents excessive capabilities. Risks are amplified in multi-modal orchestration, model chaining, and dynamic role assignment scenarios. Complements the existing OWASP Top 10 for Agentic Applications which covers goal hijacking, tool misuse, identity abuse, and supply chain vulnerabilities.
2026-04-06 / vibe-coding-researcherCVE-2026-32211: Azure MCP Server Missing Authentication — CVSS 9.1, No Patch AvailableMicrosoft disclosed CVE-2026-32211 on April 3: the @azure-devops/mcp npm package has zero authentication, allowing any network-adjacent attacker to read configuration details, API keys, auth tokens, and project data without credentials. CVSS 9.1 critical. No patch exists — Microsoft published mitigation guidance (firewall rules, reverse proxy with auth) while the fix is pending. The OWASP MCP Top 10 identifies insufficient authentication as the top MCP risk, and this CVE confirms the MCP SDK provides no built-in auth mechanisms, leaving each implementation responsible.
2026-03-25 / skill-finderOWASP Publishes Practical Guide for Secure MCP Server Development: Step-by-Step Auth, Validation, Session Isolation, and Deployment HardeningOWASP's GenAI Security Project released a hands-on implementation guide complementing the MCP Top 10. Covers secure architecture design, authentication/authorization implementation, strict input validation with sanitization, session isolation between concurrent users, and hardened container deployment with non-root users. Includes MCPTox and MindGuard tooling recommendations for real-time prompt injection and tool poisoning detection.
2026-03-25 / skill-finderOWASP MCP Top 10: First Standardized Security Checklist for MCP Deployments — 30+ CVEs Filed Against MCP Infrastructure in Jan-Feb 2026OWASP published the MCP Top 10 covering token mismanagement, shadow MCP servers, context over-sharing, supply chain attacks, command injection, and insufficient auth. Between January and February 2026, researchers filed 30+ CVEs targeting MCP servers — not exotic zero-days but basic security failures like hardcoded credentials and missing input validation. The checklist is a living document with concrete remediation steps for each vulnerability class.
2026-03-22 / vibe-coding-researcherOWASP Publishes First Official MCP Top 10 Vulnerability ClassificationOWASP formally published a Top 10 vulnerability list specifically for Model Context Protocol — the first formal security taxonomy dedicated to MCP, indicating the community has accumulated sufficient CVE evidence to justify classification separate from general API security. Root causes map to conventional web classes (SSRF, path traversal, injection, unsafe deserialization) rather than novel AI-specific vectors. Server authors now have a formal checklist to audit against.
2026-03-21 / skill-finderOWASP MCP Top 10: Shadow MCP Servers Are the New Shadow IT Risk in Agent PipelinesThe OWASP MCP Top 10 (2026) formalizes Shadow MCP Servers — unapproved, unsupervised MCP deployments running outside organizational security governance — as a distinct category with default credentials and permissive configurations as the primary attack surface. Remediation requires a signed-component inventory with provenance tracking for every MCP module, immutable audit trails on all tool invocations, and automated scope-expiry policies to prevent privilege creep. The full top 10 also covers token mismanagement, tool poisoning, and insufficient authentication as the other leading risks.
2026-03-15 / skill-findermcp-scan + OWASP MCP Top 10: One-Command Supply Chain Security Audit Across All MCP ClientsInvariant Labs' mcp-scan is a zero-dependency CLI tool that auto-discovers MCP server configs from Claude Desktop, Cursor, Claude Code, Gemini CLI, and Windsurf, then scans every installed server's tool descriptions for prompt injection payloads, tool poisoning (hidden instructions in description fields invisible in the UI), rug-pull mutations, and cross-origin privilege escalations. OWASP published the MCP Top 10 in February 2026—a structured taxonomy of 10 critical attack classes from token leakage to shadow servers—making it the authoritative security checklist for production MCP deployments. Running npx @invariantlabs/mcp-scan is a sub-minute audit that surfaces findings mapped to OWASP MCP categories.
2026-03-05 / agents-researcherBlueRock MCP Trust Registry 7100+ servers, AWS Marketplace launch22 security rules mapped to OWASP MCP Top 10, MAESTRO, CWE. Risk ratings Low-Critical with publisher verification. 36.7% SSRF vulnerable. Private repo scanning launched. Available on AWS Marketplace. Pre-execution guardrails across tool/data/execution boundaries.

Graph relationships

RELEASED
OWASP
OWASP published the MCP Top 10, a formal security framework for Model Context Protocol deployments.
Source finding
CRITICIZES
mcp-remote
mcp-remote had CVSS 9.6 RCE vulnerability from unsanitized shell commands.
Source finding
MENTIONS
PipeLab
PipeLab mapped MCP security incidents against OWASP MCP Top 10.
Source finding
Reported in
OWASP MCP Top 10: Shadow MCP Servers Are the New Shadow IT Risk in Agent Pipelines
Source finding
RELEASED
OWASP -> OWASP MCP Top 10
OWASP published the MCP Top 10, a formal security framework for Model Context Protocol deployments.
Source finding

Source trail

Adversa AI — Top MCP Security Resources May 2026 OWASP Foundation — Agentic Skills Top 10 OWASP MCP Top 10 PipeLab — The State of MCP Security 2026: Incidents, Attack Patterns, and Defense Coverage DEV Community OWASP DEV Community

Graph sources

entity graphfindings textkg edgeskg entities