This page is part of our MCP Security Center, within The MCP Guide. Want a second opinion on your setup? Request a free MCP readiness review.
The OWASP MCP Top 10 is a list of the ten most important security risk categories for systems built on the Model Context Protocol. It comes from OWASP, the nonprofit best known for the OWASP Top 10 for web applications. Security teams use it as a shared vocabulary and a checklist.
As of October 2026, the list is not final. The OWASP MCP Top 10 project page places it in "Phase 3 – Beta Release and Pilot Testing." Each category carries a :2025 suffix, and the project lead is listed as Vandana Verma Sehgal.
This guide explains each category in plain English, what it looks like in practice, and where the MCP specification addresses it. Category names are quoted exactly as they appeared on the project page on 28 October 2026.
Key Takeaways
- The OWASP MCP Top 10 lists ten risk categories, numbered MCP01:2025 to MCP10:2025.
- As of October 2026 it is in beta ("Beta Release and Pilot Testing"), so names and details may still change.
- Token and secret exposure is listed first, followed by scope creep and tool poisoning.
- Several categories, such as shadow servers and missing audit logs, are about governance, not code.
- The official MCP spec covers some categories directly, such as authentication and token handling, and leaves others to implementers.
The ten categories at a glance
| ID | Category (as listed) | In plain English |
|---|---|---|
| MCP01:2025 | Token Mismanagement & Secret Exposure | Keys and tokens leak through config, logs or model memory |
| MCP02:2025 | Privilege Escalation via Scope Creep | Permissions start narrow and quietly grow |
| MCP03:2025 | Tool Poisoning | Tools or their outputs carry malicious instructions |
| MCP04:2025 | Software Supply Chain Attacks & Dependency Tampering | A compromised package changes how a server behaves |
| MCP05:2025 | Command Injection & Execution | Untrusted input becomes a command the system runs |
| MCP06:2025 | Prompt Injection via Contextual Payloads | Hidden instructions in text the model reads |
| MCP07:2025 | Insufficient Authentication & Authorization | Identities or access rights are not checked |
| MCP08:2025 | Lack of Audit and Telemetry | Too little logging to investigate problems |
| MCP09:2025 | Shadow MCP Servers | Unapproved servers running outside governance |
| MCP10:2025 | Context Injection & Over-Sharing | One task's sensitive data reaches another |
Each category explained
MCP01:2025 - Token Mismanagement & Secret Exposure
OWASP describes hard-coded credentials, long-lived tokens, and secrets stored in model memory or logs. These can be exposed through prompt injection or debug traces. The MCP authorization security considerations require secure token storage and recommend short-lived tokens. Read more: secrets and credential leakage in MCP.
MCP02:2025 - Privilege Escalation via Scope Creep
Permissions that start small tend to expand over time. Eventually an agent can change repositories, control systems or move data it never needed. The spec's best practices page has a full "Scope Minimization" section with a progressive, least-privilege model. See excessive permissions in MCP servers.
MCP03:2025 - Tool Poisoning
An attacker compromises the tools a model relies on, or their outputs, to feed it malicious context. The tools specification says clients MUST treat tool annotations as untrusted unless they come from trusted servers. See MCP tool poisoning.
MCP04:2025 - Software Supply Chain Attacks & Dependency Tampering
A compromised dependency can change agent behavior or add a backdoor at run time. The best practices page covers one slice, malicious local server packages and startup commands. Package vetting and version pinning are left to you.
MCP05:2025 - Command Injection & Execution
An agent builds and runs commands, scripts or API calls from untrusted input without proper validation. The spec requires servers to validate all tool inputs. It also requires clients to avoid shell execution when opening authorization URLs.
MCP06:2025 - Prompt Injection via Contextual Payloads
OWASP compares this to classic injection, with the model as the interpreter and malicious text as the payload. The spec's main defense is a human in the loop. The tools page says clients SHOULD show tool inputs before calling a server. See prompt injection through MCP tool results.
MCP07:2025 - Insufficient Authentication & Authorization
Servers, tools or agents fail to verify identity or enforce access. This is where the spec is strongest. The authorization specification defines an OAuth 2.1-based flow, audience validation and scope challenges. Note that authorization is optional in MCP, so an unauthenticated server is not a spec violation. See common MCP OAuth misconfigurations.
MCP08:2025 - Lack of Audit and Telemetry
Without detailed logs, nobody can investigate an incident. OWASP recommends logging tool calls, context changes and interactions in immutable audit trails. The tools spec says clients SHOULD "log tool usage for audit purposes."
MCP09:2025 - Shadow MCP Servers
These are MCP deployments that run outside formal security governance, often with default credentials or permissive settings. Research has found many exposed servers in the wild. See exposed local MCP servers. The spec does not address governance; this one is on your organization.
MCP10:2025 - Context Injection & Over-Sharing
Shared, persistent or poorly scoped context lets sensitive data from one task, user or agent reach another. The specification overview says hosts must not transmit resource data elsewhere without user consent. See cross-server data leakage.
How the OWASP list and the MCP spec fit together
The two documents do different jobs. The spec defines how compliant software must behave. OWASP describes how real systems fail, including failures the spec cannot prevent.
| Category | Mainly addressed by |
|---|---|
| MCP01, MCP07 | The spec's authorization pages, plus your token handling |
| MCP02 | The spec's scope minimization guidance, plus your scope reviews |
| MCP03, MCP05, MCP06 | Partly the tools page; mostly client design and server code |
| MCP04, MCP08, MCP09 | Your organization's processes |
| MCP10 | The spec's data privacy principle, plus how you combine servers |
A note on the beta status
OWASP's project page lists five phases: drafting, community review, beta, final release and continuous improvement. As of October 2026 the project is in phase 3. The page gives no final release date.
That means two things. First, the list is useful now, but expect wording changes. Second, check the live page before quoting a category name in a contract or policy. During the beta, the link for MCP06 still pointed to a file with a different name ("Intent-Flow-Subversion"). That suggests the list has been renamed before.
Next step
Use the ten categories as headings for a quick self-review of your MCP setup. Our MCP readiness audit maps your servers to each category and shows where the gaps are.
Frequently asked questions
Is the OWASP MCP Top 10 final?
No. As of October 2026, the project page shows it in "Phase 3 – Beta Release and Pilot Testing." Category names and descriptions may still change before the final release.
What is the number one risk on the list?
MCP01:2025 is "Token Mismanagement & Secret Exposure." It covers hard-coded credentials, long-lived tokens, and secrets exposed through logs or model memory.
How is this different from the OWASP Top 10 for LLM applications?
The LLM list covers risks in any application built on large language models. The MCP list focuses on risks specific to MCP servers, clients and the way they connect tools and data.
Does following the MCP spec cover all ten?
No. The spec addresses authentication, token handling and some tool rules. Supply chain, shadow servers and audit logging depend mostly on your own processes.
What license is the OWASP MCP Top 10 under?
The project page lists CC BY-NC-SA 4.0. Check the page for the current terms before reusing its text.
