The Model Context Protocol has become the integration layer between language models and enterprise systems — and thus a new, often unexamined trust boundary. The OWASP MCP Top 10 name the ten risks of this layer.
Within just a few quarters, the Model Context Protocol (MCP) has established itself as the de facto standard through which AI agents access repositories, mailboxes, databases, and CRM systems. Public surveys count more than 10,000 active public MCP-Servers, of which only around 8.5 percent use OAuth; 88 percent of the organizations surveyed report confirmed or suspected incidents involving AI agents. The OWASP work on the MCP Top 10 (Version v0.1, Beta) is the first to structure this attack surface into ten distinct risks. VamiSec groups these ten risks thematically below and adds concrete controls to each group, along with a mapping to common standards and regulations. The English risk names follow the OWASP taxonomy; the framing, presentation, and recommendations for action are VamiSec's own.
The first cluster asks: who is actually allowed to do what here? It covers MCP01 Token Mismanagement & Secret Exposure, MCP02 Privilege Escalation via Scope Creep, and MCP07 Insufficient Authentication & Authorization. At its core, long-lived tokens end up in the model context, permissions grow along across releases, and the identities of agents and servers are not verified sufficiently.
This covers MCP03 Tool Poisoning — with the subtypes Rug Pull, Schema Poisoning, and Tool Shadowing — as well as MCP04 Software Supply Chain Attacks & Dependency Tampering. Attackers alter Tool descriptions, schemas, or dependencies that the model reads but that a human never gets to see. A single minor update or a falsified schema is enough for agents to do the wrong thing in a perfectly contract-compliant way.
The “What gets executed?” cluster brings together MCP05 Command Injection & Execution and MCP06 Prompt Injection via Contextual Payloads. The agent assembles system commands or follows instructions from untrusted context — for example from retrieved documents or public issues. Model hardening reduces Prompt Injection but does not eliminate it; what works are architectural controls such as provenance separation and egress allowlists.
The governance cluster begins with MCP08 Lack of Audit and Telemetry and MCP09 Shadow MCP Servers. Without complete call logs, it is impossible during an incident to reconstruct which agent called which Tool with which parameters. Unapproved MCP instances, frequently run locally, additionally evade any formal control.
MCP10 Context Injection & Over-Sharing concerns the agents' working memory: shared, persistent, or insufficiently delimited contexts across sessions and tenants. When context is shared out of convenience, a data leak arises — up to cross-tenant exposure. Persistent context also constitutes processing within the meaning of the GDPR and requires a scope, a TTL, and a deletion path.
VamiSec maps each of the ten risks to concrete controls as well as to the requirements of ISO/IEC 27001, ISO/IEC 42001, EU AI Act, NIS2, DORA, and the Cyber Resilience Act. The target architecture consists of a multi-layered protection architecture and an MCP-Gateway as a binding control point. A 30/60/90-day roadmap turns the analysis into auditable artifacts.
The content on this page is based on the following publicly available guides and studies.
Project lead Vandana Verma Sehgal; licensed under CC BY-NC-SA 4.0. Early beta stage (roadmap phase Pilot Testing), not a finalized standard; provides the English risk names.
Covers, among other things, Confused Deputy, Token Passthrough, and OAuth 2.1; the ecosystem was handed over to the Agentic AI Foundation under the umbrella of the Linux Foundation.
OS command injection via OAuth discovery fields; over 437,000 potentially affected environments (published July 9, 2025).
24,008 secrets in public MCP configuration files on GitHub, of which 2,117 are still valid.
Prompt Injection as the fastest-growing threat type in AI security (reports rose by 540 percent).
VamiSec evaluates your MCP and agent landscape along the OWASP MCP Top 10 — from token and permission analysis, through the review of Tools and gateway, to the penetration test. Schedule an initial consultation.
