A practical guide to understanding the OWASP MCP Top 10 and protecting the tools, data, and corporate systems connected to AI agents
From conversational assistant to actor within the system
Artificial intelligence is evolving from assistants that answer questions into agents capable of consulting documentation, interacting with applications, and executing operations. The Model Context Protocol (MCP) facilitates these integrations through a common interface between the AI application and the data sources or tools it needs to use.
An MCP server can expose resources and tools capable of querying a support platform, accessing a repository, or invoking an API. The model receives a description of those capabilities and decides which one to use. This architecture accelerates development, but it introduces a fundamental change: an incorrect response may cease to be just text and become an action on a real system.
The model's decision is not equivalent to authorization
The model may select a tool because it interprets it as useful for completing the task. However, that decision is probabilistic and can be influenced by the user's message, the conversation history, or the content of an external document. Therefore, authorization should not reside in the prompt or depend on the model "understanding" a policy.Every operation must be verified on the MCP server and on the target system using the user's identity and effective permissions. If a person cannot directly view or modify a resource, they should not be able to achieve it through the agent either.
OWASP MCP Top 10: Executive view of the main risks
OWASP maintains a dedicated Top 10 for MCP that groups risks related to credentials, privileges, tools, dependencies, context, and governance. As of August 2026, the project is in beta and publishes version v0.1; OWASP expects a subsequent revision in October 2026. It should be used as a living analysis guide and not as a closed security certification.
MCP01 — Poor Token Management and Secret Exposure
Overview. MCP servers require credentials to connect to repositories, databases, cloud services, and other corporate applications. The problem arises when these credentials are included in configuration files, process-accessible variables, conversations, persistent memories, or debugging logs. MCP particularly expands this risk because a secret may traverse multiple layers and end up stored in locations that were not initially considered credential repositories.Business risk. Embedded credentials, long-lived tokens, or secrets present in memory, logs, and traces may become exposed through an injection attack, a diagnostic error, or a compromised server.
Documented case. Check Point Research documented vulnerabilities CVE-2025-59536 and CVE-2026-21852 in Claude Code. A malicious repository could include configurations and hooks capable of triggering code execution and exfiltrating credentials and tokens when a developer worked with the project. The case demonstrates that configuration files associated with MCP tools are part of the trust boundary: if they contain manipulated commands or references, secrets available in the environment may become exposed.
https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/
Priority control. Centralize secrets, use short-lived and scoped tokens, prevent them from reaching the model's context, and review logs and repositories.
MCP02 — Privilege Escalation Through Scope Expansion
Overview. Scope expansion occurs when an agent starts with limited permissions but gradually accumulates new capabilities due to convenience, temporary testing, or configuration changes. An assistant that initially only needed to view incidents may eventually gain the ability to modify tickets, download files, or administer the system. The risk does not necessarily reside in a single critical permission grant, but in the progressive accumulation of privileges.Business risk. Permissions initially granted for testing may accumulate until they allow repository modifications, system administration, or data extraction. The risk appears when scopes are broad, persistent, or not reviewed.
Documented case. In May 2025, Invariant Labs demonstrated an attack against GitHub's official MCP server. The agent used a Personal Access Token with access to public and private repositories. A malicious instruction placed in a public issue could influence the agent, cause it to consult private repositories, and publish the obtained information in a visible pull request. The injection was the trigger, but the impact depended on the breadth of the token and on combining untrusted content reading, private access, and publishing capability under a single identity.
Reference: https://invariantlabs.ai/blog/mcp-github-vulnerability
Priority control. Apply least privilege, automatic expiration, separation between read and write operations, and periodic permission reviews.
MCP03 — Tool Poisoning
Overview. Agents use a tool's name, description, and schema to decide when and how to invoke it. These metadata elements are not merely documentation: they become part of the context that guides the model. In a Tool Poisoning attack, an apparently legitimate tool includes hidden or deceptive instructions, impersonates another tool, or returns results designed to influence subsequent decisions.Business risk. A tool, its description, its schema, or its output can manipulate the model's selection process and behavior. OWASP includes techniques such as malicious updates, schema poisoning, and fake or duplicate tools.
Documented case. Invariant Labs created an apparently harmless MCP tool that provided a "fact of the day." Its description contained hidden instructions directed at the model. When operating alongside a legitimate WhatsApp server, the malicious tool could alter the way the agent used messaging functions and trigger the transmission of conversation history to a phone number controlled by the attacker. The demonstration was performed on real MCP servers and clients; the behavior originated from metadata that conventional interfaces normally do not display.
Reference: https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks
Priority control. Inventory and approve tools, pin versions, verify integrity, and review changes in descriptions, schemas, and outputs.
MCP04 — Supply Chain Attacks
Overview. An MCP server depends on SDKs, packages, container images, connectors, plugins, and tools from different vendors. A compromised dependency executes within a trusted path and may access context, modify tools, capture credentials, or introduce a backdoor. In agentic environments, a single update may automatically alter the behavior of numerous agents.Business risk. MCP servers, connectors, and plugins depend on external packages and components. A vulnerable or compromised dependency can alter agent behavior or introduce a backdoor.
Documented case. In 2026, OX Security published research on a systemic weakness related to MCP's STDIO transport configuration. The insecure pattern had spread across multiple products and adapters, including LangFlow, Flowise, and Letta AI. In certain implementations, controllable MCP configurations could reach subprocess creation and ultimately execute commands. The relevance to MCP04 lies in propagation: a pattern present in reused components ended up affecting multiple projects and amplifying the scope of the issue.
Reference: https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/
Priority control. Maintain an SBOM, pin dependencies, verify provenance and signatures, monitor vulnerabilities, and control updates.
MCP05 — Command Injection and Execution
Overview. Some MCP servers can manage infrastructure, execute development tools, or interact with the operating system. To do so, they transform parameters received from the agent into commands, queries, or API calls. If these values are directly concatenated into a shell command, an attacker may introduce metacharacters and add unintended operations because a parameter originating from a model is not inherently safe.Business risk. Inputs originating from users, documents, or external services may reach a shell, query, API, or interpreter without validation. The model's ability to construct parameters does not make those parameters trustworthy.
Documented case. The mcp-server-kubernetes server, up to version 2.4.9, contained a command injection vulnerability in tools such as kubectl_scale, kubectl_patch, and explain_resource. It incorporated unvalidated parameters into calls through child_process.execSync, allowing metacharacter injection and command execution with the process's privileges. The advisory also documented how an indirect prompt injection, introduced for example through pod logs, could lead from external content to arbitrary command execution. The issue was fixed in version 2.5.0.
Reference: https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-gjv4-ghm7-q58q
Priority control. Avoid shells when a secure API exists, use allowlists and structured parameters, isolate execution, and restrict identity and network access.
MCP06 — Intent Flow Subversion / Contextual Prompt Injection
Overview. The intent flow represents the objective the user expects the agent to accomplish. It may be altered when the model encounters additional instructions inside a ticket, document, email, web page, or tool output. The model does not always differentiate between information it should analyze and instructions it should follow, because content that would be considered data in a conventional application may become a secondary control channel.Business risk. Content retrieved by the agent may act as a second instruction channel and redirect the task toward an attacker's objective. A ticket, web page, or PDF may contain the payload.
Documented case. Research on Supabase MCP demonstrated a reproducible scenario in which Cursor used the MCP server with a service_role credential capable of bypassing Row-Level Security controls. When the agent processed a support ticket containing malicious instructions, it could interpret them as commands, query private tables, and return the information through the ticket itself. The original objective became replaced by the attacker's objective.
Reference: https://generalanalysis.com/blog/supabase-mcp-blog
Priority control. Treat all retrieved content as untrusted data, separate instructions from context, reduce available tools, and require confirmation for sensitive actions.
MCP07 — Insufficient Authentication and Authorization
Overview. Multiple identities participate in an MCP architecture: user, client, model, agent, server, and target system. The risk appears when the original identity is lost along the way or replaced with a shared service account. Authenticating the connection is not sufficient; every tool must verify whether the user is allowed to perform the specific operation and access the requested object, project, or customer.Business risk. In ecosystems involving users, models, agents, and services, it is easy to lose the original identity or rely on a shared technical account. Without per-operation controls, the agent may exceed the user's permissions.
Documented case. JFrog discovered CVE-2025-6515 in oatpp-mcp. The implementation generated session identifiers from memory addresses, making them predictable or reusable. An attacker could create and close sessions, wait for one of those identifiers to be assigned to a victim, and send requests using the known ID. The server would treat those requests as belonging to the legitimate session and could inject prompts or events into another client's communication.
Reference: https://jfrog.com/blog/mcp-prompt-hijacking-vulnerability/
Priority control. Propagate identity end to end, apply RBAC or ABAC on every tool, and validate ownership, tenant, and access purpose.
MCP08 — Lack of Auditing and Telemetry
Overview. An MCP operation may traverse the user, model, server, tool, and target application. If each component generates independent logs, it may become impossible to reconstruct who initiated the action, what context influenced the model, and why the operation was allowed. The opposite problem also exists: logging complete conversations may introduce secrets and personal data into the monitoring platform.Business risk. Without records of invocations, context changes, and results, improper actions may go unnoticed and be difficult to investigate. Logging everything indiscriminately may also expose prompts or secrets.
Documented case. In 2026, Bishop Fox analyzed the logging capabilities available in MCP servers while adding protocol support to its Otto tool. The research noted that remote servers can behave as a black box: the client observes the request and response, but not necessarily the internal execution, consulted resources, or intermediate actions. It also highlighted a significant gap between perception and visibility: many stakeholders trusted their policies, but only a minority reported having complete visibility into permissions, tools, and data access. This is not a CVE, but rather an operational deficiency observed in real-world deployments.
Reference: https://bishopfox.com/blog/otto-support-logging-visibility-in-mcp-servers
Priority control. Create correlated and protected traces, log relevant decisions and authorizations, minimize sensitive data, and generate alerts.
MCP09 — Shadow MCP Servers
Overview. Shadow MCP servers are deployments installed outside corporate inventory, review, and monitoring procedures. They may appear when a developer installs a connector for testing purposes or when a team publishes an integration without involving security teams. These servers may retain credentials, listen on unintended interfaces, or expose tools with operating system access.Business risk. Development teams may deploy servers outside corporate governance processes in order to experiment quickly. These nodes may use default credentials, open APIs, or excessive access to data.
Documented case. Backslash Security analyzed public MCP deployments and found hundreds of servers configured to listen on 0.0.0.0, making services intended for local use accessible from other machines on the same network. The researchers called this exposure NeighborJack.
They also identified dozens of servers capable of executing commands without sufficient validation, as well as multiple cases where network exposure and arbitrary command execution were present simultaneously.
Reference: https://www.backslash.security/blog/hundreds-of-mcp-servers-vulnerable-to-abuse
Priority control. Discover and inventory deployments, provide an approved platform, control outbound communications and credentials, and define a streamlined onboarding process.
MCP10 — Context Injection and Excessive Context Sharing
Overview. Context may include messages, retrieved documents, tool outputs, historical memory, and intermediate data from other agents. Sharing it improves continuity, but increases the likelihood that information from one task will appear in another. Separation must be enforced by user, organization, session, and purpose; it is not sufficient to ask the model to ignore information that it should never have received.Business risk. Persistent memories or poorly isolated contexts may mix information across users, agents, tasks, or customers. Context improves the user experience, but it can also become a leakage channel.
Documented case. In June 2025, Asana temporarily disabled its MCP functionality after discovering a flaw that could result in information exposure between organizations. According to incident communications, projects, teams, tasks, and other objects belonging to one organization could become accessible to another. The issue affected tenant isolation: if resource retrieval is not bound to the correct tenant, the model may receive information that the user was never authorized to access.
Reference: https://authzed.com/blog/timeline-mcp-breaches
Priority control. Isolate sessions and tenants, minimize and expire memory, classify data, prevent unauthorized reuse, and test for context leakage.
How It Would Affect a Corporate Project
Consider an assistant connected to a support platform or Help Desk. Its function is to consult incidents, summarize conversations, and propose responses. The integration appears low risk until it can also download attachments, modify tickets, or access cases belonging to multiple customers.A manipulated document could contain instructions directed at the model. If the server uses an account with broad access and does not verify permissions on each request, customer isolation would ultimately depend on the behavior of the agent. In that scenario, MCP06, MCP07, and MCP10 converge, and if traceability is also lacking, MCP08 would make it more difficult to detect and reconstruct the incident.
As a design principle, a system instruction may guide the agent, but it does not replace a security boundary. Deterministic controls must limit what happens when the model makes a mistake or is manipulated.
A Minimum Framework for Secure MCP Adoption
▪️ Start with read-only operations and low-sensitivity data before enabling modifications.▪️ Maintain an inventory of servers, tools, owners, accessible data, credentials, and dependencies.
▪️ Separate read, write, and administrative functions through different credentials and scopes.
▪️ Require human confirmation or additional authorization for irreversible, financial, or high-impact operations.
▪️ Test for indirect prompt injection, user and tenant isolation, object-level authorization, and tool manipulation.
▪️ Integrate MCP into code review, vulnerability management, monitoring, and incident response processes.
Conclusion
The adoption of the Model Context Protocol (MCP) is accelerating the integration of artificial intelligence systems with applications, databases, repositories, and corporate services. However, this capability also turns AI agents into new actors within the infrastructure: they can access sensitive information, use credentials, and perform actions with real-world consequences.For this reason, securing an MCP-based ecosystem requires more than reviewing prompts or applying isolated controls. It is necessary to analyze the entire architecture, data flows, identities, permissions, available tools, secret management, dependencies, traceability, and the way agents interact with corporate systems.
Internet Security Auditors offers a Comprehensive Security Audit for AI Ecosystems, adaptable to the architecture and maturity level of each organization. Its scope may include:
▪️ Technical audits of AI platforms, infrastructures, MLOps environments, and configurations.
▪️ Assessment of AI-powered applications, chatbots, RAG systems, and integrated APIs.
▪️ Security testing and red teaming exercises targeting LLMs, agents, and orchestration layers.
▪️ Dedicated audits of MCP servers, connectors, plugins, and tools.
▪️ Review of authentication, authorization, secret management, and handling of sensitive data.
▪️ Testing for prompt injection, context leakage, tool abuse, and privilege escalation.
▪️ Fuzzing, dependency analysis, code review, and threat modeling.
▪️ Evaluation of event logging, telemetry, traceability, and incident response capabilities.
The service combines offensive testing and technical review to identify vulnerabilities, insecure configurations, and operational risks before they can impact data, users, or connected systems. As a result, the organization receives prioritized findings, technical evidence, concrete recommendations, and an action plan tailored to its environment.
If your organization is developing agents, deploying MCP servers, or connecting AI models to internal systems, now is the time to verify whether those capabilities operate within truly enforceable security boundaries.
Request an assessment of your AI ecosystem or a dedicated audit of your MCP-based integrations with Internet Security Auditors.
References
🔗OWASP Foundation, “OWASP MCP Top 10,” OWASP. [En línea]. Disponible en: https://owasp.org/www-project-mcp-top-10/.
🔗OWASP GenAI Security Project, “A Practical Guide for Secure MCP Server Development,” 16 feb. 2026. Disponible en: https://genai.owasp.org/resource/a-practical-guide-for-secure-mcp-server-development/.
🔗OWASP GenAI Security Project, “OWASP Top 10 for Agentic Applications for 2026,” 9 dic. 2025. Disponible en: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/.
🔗OWASP GenAI Security Project, “CheatSheet: A Practical Guide for Securely Using Third-Party MCP Servers 1.0,” 4 nov. 2025. Disponible en: https://genai.owasp.org/resource/cheatsheet-a-practical-guide-for-securely-using-third-party-mcp-servers-1-0/.
🔗PortSwigger, “Web LLM attacks,” Web Security Academy. Disponible en: https://portswigger.net/web-security/llm-attacks.
🔗Invariant Labs, “GitHub MCP Exploited: Accessing Private Repositories via MCP,” 26 may. 2025. Disponible en: https://invariantlabs.ai/blog/mcp-github-vulnerability.
🔗Invariant Labs, “MCP Security Notification: Tool Poisoning Attacks,” 1 abr. 2025. Disponible en: https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks.
🔗OX Security, “MCP STDIO Command Injection: Full Vulnerability Advisory,” OX Security. Disponible en: https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/.
🔗Flux159, “mcp-server-kubernetes vulnerable to command injection in several tools,” GitHub Security Advisory, GHSA-gjv4-ghm7-q58q, 8 jul. 2025. Disponible en: https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-gjv4-ghm7-q58q.
🔗General Analysis, “Supabase MCP can leak your entire SQL database.” Disponible en: https://generalanalysis.com/blog/supabase-mcp-blog.
🔗JFrog Security Research, “CVE-2025-6515: Prompt Hijacking Attack Affects MCP Ecosystem,” JFrog. Disponible en: https://jfrog.com/blog/mcp-prompt-hijacking-vulnerability/.
🔗Bishop Fox, “Otto Support: Logging and Visibility in MCP Servers.” Disponible en: https://bishopfox.com/blog/otto-support-logging-visibility-in-mcp-servers.
🔗Backslash Research Team, “Threat Research: Hundreds of MCP Servers Vulnerable to Abuse,” Backslash Security, 25 jun. 2025. Disponible en: https://www.backslash.security/blog/hundreds-of-mcp-servers-vulnerable-to-abuse.
🔗AuthZed, “A Timeline of Model Context Protocol (MCP) Security Breaches.”. Disponible en: https://authzed.com/blog/timeline-mcp-breaches.
