AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The owasp-mcp skill provides a comprehensive, machine-readable reference for the OWASP MCP Top 10 (2025). It is designed to help developers and security professionals identify, assess, and remediate common security vulnerabilities inherent in Model Context Protocol architectures. By structuring these risks into standardized documents, the skill enables AI agents to perform security audits, provide defensive guidance, and suggest remediation strategies for issues ranging from credential mismanagement to tool poisoning and shadow server deployment.
What it does
- Provides a structured index of the OWASP MCP Top 10 security vulnerabilities.
- Offers detailed descriptions, impact assessments, and vulnerability checklists for each risk.
- Supplies defensive design patterns and prevention controls for MCP architectures.
- Includes realistic attack scenarios to help visualize potential exploitation paths.
- Provides actionable detection signals and remediation steps for security incidents.
When to use it
- During the design phase of an MCP server or client to implement secure-by-design principles.
- When auditing an existing MCP implementation for potential security gaps.
- To train or prompt an AI agent to assist in identifying security risks within an MCP-based workflow.
- When responding to a suspected security incident involving MCP tool calls or context sharing.
Advantages
- Aligned with industry-standard OWASP security research.
- Structured for machine-readability, making it ideal for AI-assisted security analysis.
- Covers a broad spectrum of risks specific to the Model Context Protocol ecosystem.
- Provides clear, actionable remediation guidance for developers.
Usage examples
- “What are the security risks associated with tool poisoning in an MCP environment?”
- The agent will reference the MCP03:2025 documentation to explain the risks of tool poisoning, provide a checklist for identifying vulnerable configurations, and suggest prevention controls.
- “How can I prevent secret exposure in my MCP server implementation?”
- The agent will retrieve the MCP01:2025 reference to outline best practices such as using secure vaults, enforcing short-lived tokens, and implementing log redaction.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/owasp-mcp/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip owasp-mcp.zip -d .agents/skills
Documentation by Microsoft
OWASP® MCP Top 10 — Skill Entry
This SKILL.md is the entrypoint for the MCP Vulnerabilities skill.
The skill encodes the OWASP MCP Top 10 (2025) as structured, machine-readable references that an agent can query to identify, assess, and remediate MCP security risks.
Normative references (MCP Top 10)
Skill layout
SKILL.md— this file (skill entrypoint).references/— the MCP Top 10 normative documents.00-vulnerability-index.md— index of all vulnerability identifiers, severities, and cross-references.01through10— one document per vulnerability aligned with OWASP MCP numbering.
Third-Party Attribution
Copyright © OWASP Foundation. OWASP® MCP Top 10 content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://owasp.org/www-project-mcp-top-10/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.
Files
- ATTRIBUTION.mdAdded by AutoGineer973 B
- LICENSEAdded by AutoGineer17.9 KiB
- SKILL.md2.5 KiB
- references/00-vulnerability-index.md2.7 KiB
- references/01-token-mismanagement-secret-exposure.md3.8 KiB
- references/02-privilege-escalation-scope-creep.md3.7 KiB
- references/03-tool-poisoning.md3.9 KiB
- references/04-supply-chain-attacks-dependency-tampering.md4.0 KiB
- references/05-command-injection-execution.md4.4 KiB
- references/06-prompt-injection-contextual-payloads.md3.8 KiB
- references/07-insufficient-authentication-authorization.md4.1 KiB
- references/08-lack-of-audit-telemetry.md4.1 KiB
- references/09-shadow-mcp-servers.md4.1 KiB
- references/10-context-injection-over-sharing.md3.6 KiB
references/00-vulnerability-index.md
title: OWASP MCP Top 10 Vulnerability Index description: Index of OWASP MCP Top 10 (2025) vulnerability identifiers, categories, and cross-references
00 Vulnerability Index
This document provides the index for the OWASP MCP Top 10 (2025) vulnerabilities. Each entry includes its identifier, title, and primary attack category.
Vulnerability catalog
| ID | Title | Category |
|---|---|---|
| MCP01:2025 | Token Mismanagement and Secret Exposure | Credential Hygiene |
| MCP02:2025 | Privilege Escalation via Scope Creep | Access Control |
| MCP03:2025 | Tool Poisoning | Supply Chain / Integrity |
| MCP04:2025 | Software Supply Chain Attacks and Dependency Tampering | Supply Chain / Integrity |
| MCP05:2025 | Command Injection and Execution | Injection |
| MCP06:2025 | Prompt Injection via Contextual Payloads | Injection |
| MCP07:2025 | Insufficient Authentication and Authorization | Access Control |
| MCP08:2025 | Lack of Audit and Telemetry | Observability |
| MCP09:2025 | Shadow MCP Servers | Governance |
| MCP10:2025 | Context Injection and Over-Sharing | Data Isolation |
Cross-reference matrix
Each vulnerability document follows a consistent structure:
Description — what the vulnerability is and why it matters in MCP contexts.
Impact — concrete consequences of exploitation.
Vulnerability checklist — indicators that the environment is exposed.
Prevention controls — defensive design patterns and governance.
Example attack scenarios — realistic exploitation narratives.
Detection guidance — signals and indicators of compromise.
Remediation — immediate actions to contain and resolve.
Category groupings
Injection
MCP05:2025 Command Injection and Execution
MCP06:2025 Prompt Injection via Contextual Payloads
Access Control
MCP02:2025 Privilege Escalation via Scope Creep
MCP07:2025 Insufficient Authentication and Authorization
Supply Chain and Integrity
MCP03:2025 Tool Poisoning
MCP04:2025 Software Supply Chain Attacks and Dependency Tampering
Credential Hygiene
MCP01:2025 Token Mismanagement and Secret Exposure
Data Isolation
MCP10:2025 Context Injection and Over-Sharing
Observability
MCP08:2025 Lack of Audit and Telemetry
Governance
MCP09:2025 Shadow MCP Servers
Requirements and compatibility
Written for: GitHub Copilot, Claude Code
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Claude Code frontmatter, Needs an MCP server
Security
What our scanner noticed· Medium risk
- References to credential files
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/hve-core · .github/skills/security/owasp-mcp · commit f425e94
- Licence
- Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
- LICENSE (written by AutoGineer)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download owasp-mcp.zip