The Model Context Protocol decides at runtime which tool your AI agent calls – based on tool descriptions and retrieved content. This shifts the trust boundary to a place that classic threat models do not cover. We model your MCP landscape systematically: with STRIDE as the entry point, MAESTRO for architectural placement and the OWASP MCP Top 10 as the risk catalog.
MCP deliberately ships without security mechanisms of its own – the specification assumes that development and security enforce the usual controls themselves. At the same time, an MCP agent behaves unlike any classic application: it is not deterministic, decides autonomously which tools to call and effectively treats returned content as instructions. A threat model that only looks at data flows between components therefore misses precisely the attack paths that are exploited in practice – from manipulated tool descriptions to servers that undermine the trust model itself.
The absence of built-in security in MCP is not a defect, but instead emphasizes the expectation that developers will implement standard security best practices.
Red Canary (A Zscaler Company), Jesse Griggs, 2025
No framework on its own describes an MCP landscape completely. We combine three – each answers a different question.
What can go wrong?
Six timeless categories – Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Fast, easy to grasp and compatible with any existing security organization. The entry point that brings your team along immediately.
Where exactly does the threat sit?
The agentic threat modeling framework of the Cloud Security Alliance assigns threats to seven architecture layers – from the language model to the agent ecosystem – and makes attack chains across layer boundaries visible. MCP itself lives on layer 3.
Which concrete risks?
Ten documented MCP risks – from Token mismanagement through Tool Poisoning to Context Over-Sharing. They provide the practical grounding and a shared language with development, internal audit and auditors.
This combination is not an in-house construct: the OWASP Agentic Security Initiative explicitly describes MAESTRO as a comprehensive extension of STRIDE for agentic systems. The three lenses do not contradict each other – they stack.
Seven layers, seven threat profiles. The mapping follows the OWASP Multi-Agentic System Threat Modeling Guide, whose threat modeling lead is the author of MAESTRO himself.
Tool Poisoning via manipulated descriptions, client impersonation with stolen credentials, insecure JSON-RPC and streaming implementations, schema mismatches between client and server, mutual interference between several clients on a shared server.
Prompt Injection as adversarial input, cascading hallucinations across several tool calls, unexpected code execution, poisoning of the agent memory.
Exfiltration from vector databases and RAG pipelines via connected MCP servers, semantic drift in linked data sources, manipulated retrieval content that is read as an instruction.
Resource exhaustion through expensive tool calls, exposed service accounts and long-lived keys, MCP servers unintentionally reachable from the network, container and orchestration weaknesses.
Missing traceability and deniability of agent actions, insufficient logging in the MCP server, manipulated or selectively deleted logs – the blind spot of any later forensic analysis.
Privilege Escalation through overly broad Tokens, missing isolation of server permissions and violations of Least Privilege, data residency and compliance breaches caused by the choice of server.
Malicious MCP servers that pose as legitimate and thereby attack the trust model itself, Rogue Agents in multi-agent networks, poisoning of agent-to-agent communication, manipulated registries and tool discovery.
The threat labels follow the OWASP taxonomy for agentic systems; the layer structure follows the MAESTRO reference architecture of the Cloud Security Alliance. Layer 6 is defined as a cross-cutting layer spanning all others.
So your team does not have to relearn anything: the six familiar categories, each with the concrete MCP attack picture and the matching entry from the OWASP MCP Top 10.
Agents have no identity of their own by default. Client and server impersonation as well as stolen credentials are barely distinguishable from legitimate traffic.
MCP01 · MCP09Tool Poisoning: what a human reads in the interface is not necessarily what the model receives as a description – and then acts on.
MCP03Without built-in identifiers the agent accesses systems like an ordinary user. Without deliberate instrumentation, attribution is missing later on.
MCP08Missing isolation mixes confidential and public sources in the same context; secrets and long-lived keys end up in agent contexts.
MCP10A model with an unbounded query tool generates expensive queries and load peaks – the disruption comes from your own agent, not from outside.
MCP05Confused Deputy and overly broad Tokens: the agent inherits permissions that the actual task was never entitled to.
MCP02 · MCP07MCP01–MCP10 refer to the OWASP Top 10 for Model Context Protocol (v0.1, Beta – project in pilot phase).
The value of a layered model lies precisely where attacks change layers. That is why cross-layer analysis is a work step of its own for us – not a footnote.
Example chain from the MAESTRO documentation: a flaw in the container infrastructure grants access to a running agent instance, through which data in memory is poisoned – the next model update makes the manipulation permanent.
Not a slide marathon, but artifacts that architecture, operations and internal audit can keep working with.
Your MCP landscape documented: hosts, clients, connected servers, tools, resources and transport paths – with trust boundaries explicitly marked. The basis for every further discussion.
Threats along the seven MAESTRO layers, each with STRIDE category, attack path and reference to the OWASP MCP Top 10 – demonstrated rather than asserted.
The paths that change layers, modeled as end-to-end scenarios – including the point at which the chain is broken at the lowest cost.
Every threat rated by likelihood and impact, aligned with your risk methodology – so the order of measures is justified and does not have to be debated.
Concrete controls per layer: bounded tools instead of unbounded queries, Least Privilege per tool, short-lived and audience-bound Tokens, telemetry – and where an MCP-Gateway holds up as a mandatory control point.
The model prepared so that it can be used as evidence for ISO 27001, ISO/IEC 42001, EU AI Act, NIS2, DORA or CRA – one analysis, usable several times over.
Six steps along the MAESTRO methodology – as a workshop format or embedded in the development cycle.
We record your MCP landscape and decompose it along the seven layers: which hosts and clients exist, which servers are connected, which tools exist, which data and permissions are attached to them – and where each trust boundary runs.
For each layer we identify the relevant attack classes. STRIDE serves as a checklist so that no category slips through; the OWASP MCP Top 10 provide the documented practical grounding.
We model chains that change layers – Supply Chain, Lateral Movement, Privilege Escalation, Data Leakage and goal-misalignment cascades – and identify the most effective break points.
Rating by likelihood and impact, fitted into your existing risk methodology. The result is a justified prioritization, not a wish list.
Controls per layer plus the AI-specific measures that classic hardening does not cover. We state explicitly which risks have to be solved architecturally and which are settled through configuration.
A threat model that is created once and then ages is worthless. We anchor telemetry and repeat points so the model grows with every new server and every release – with automated threat modeling in CI/CD if desired.
Threat modeling is not busywork; it delivers the evidence that several regulatory frameworks demand from you anyway.
Risk-based management, access control, Least Privilege and logging – demonstrated on the actual system instead of in the policy.
Evidence that risks of the AI management system are determined and treated systematically – including agent behavior.
Basis for risk management and technical documentation when your agents operate in regulated use cases.
Risk management and supply chain security – connected MCP servers are part of your digital Supply Chain.
ICT risk management and third-party risk in the financial sector, applied cleanly to the agent architecture.
If you ship MCP servers or agentic features: threat analysis as part of the required security documentation.
In a 30-minute initial call we clarify how many MCP servers are actually connected in your environment, where the trust boundaries run and whether a workshop format or continuous modeling is the better fit.
