OWASP MCP Top 10 Explained for Business Owners

In short: OWASP, the nonprofit best known for its web security Top 10, has started an MCP Top 10 listing the ten most likely ways to compromise a deployment of the Model Context Protocol, the standard AI agents use to connect to tools and data. The project is currently in beta and its items are labelled with the 2025 edition, so expect changes. For a business owner the list works as a question sheet for any supplier building or running AI agents for you.

Key Takeaways

• The OWASP MCP Top 10 is a beta project. Its ten items carry the label "2025" and may change before a final release.
• The list covers secrets, over-broad permissions, poisoned tools, supply chain risk, command injection, prompt injection, weak authentication, missing logs, unapproved servers and data leaking between tasks.
• None of the ten needs a security background to ask about. Most reduce to who can do what, what is logged, and what you do not know is running.
• If a supplier cannot say how they handle the first three, treat that as a warning sign.

The Ten Risks in Plain English

The names below are OWASP's own. The explanations and questions are ours.

• MCP01 Token Mismanagement and Secret Exposure. Hard-coded or long-lived credentials leak through the model's memory, logs or debug output. Ask: Where are the agent's credentials stored, and how often are they rotated?
• MCP02 Privilege Escalation via Scope Creep. Permissions loosen or grow over time until the agent can do more than it needs. Ask: What is the agent's exact permission list, and who reviews it?
• MCP03 Tool Poisoning. A compromised tool, plugin or its output feeds malicious or misleading context to the model. Ask: Who vets the tools the agent can call?
• MCP04 Software Supply Chain Attacks and Dependency Tampering. A compromised dependency changes agent behaviour or adds a backdoor. Ask: How are dependencies pinned and scanned?
• MCP05 Command Injection and Execution. The agent builds and runs commands or code from untrusted input without checking it. Ask: Can the agent run shell commands, and from what input?
• MCP06 Prompt Injection via Contextual Payloads. Instructions hidden in content the model reads, such as an email or web page, steer its behaviour. Ask: What happens if a document tells the agent to ignore its rules?
• MCP07 Insufficient Authentication and Authorization. Servers, tools or agents fail to verify who is calling or enforce access limits. Ask: How does each server check identity?
• MCP08 Lack of Audit and Telemetry. Tool calls and context changes are not logged, so incidents cannot be investigated. Ask: Can you show me a log of everything the agent did last week?
• MCP09 Shadow MCP Servers. Unapproved MCP deployments run outside governance, often with weak defaults. Ask: Is there an inventory of every MCP server in use?
• MCP10 Context Injection and Over-Sharing. Shared or persistent context exposes one task's, user's or agent's data to another. Ask: Is customer data kept separate between tasks and users?

Three Themes Worth Remembering

Authority is the biggest lever. Scope creep, weak authentication and tool poisoning are different routes to the same outcome: an agent that can do something it should not. Fixing authority limits first reduces the damage from nearly everything else on the list.

You cannot defend what you cannot see. Missing logs and shadow servers are visibility problems. An agent whose actions are recorded and whose servers are inventoried is far easier to govern than a clever one you cannot inspect.

Content is an attack route. Prompt injection and context over-sharing both come from what the agent reads. Anything an agent ingests from outside, including emails, tickets and web pages, should be treated as untrusted.

A Simple Way to Use the List

1. Print the table and put it in front of whoever builds or runs your agents.
2. Ask each question and note the answer, or the lack of one.
3. Start with MCP01, MCP02 and MCP08. Secrets, permissions and logs are the cheapest to fix and the most revealing.
4. Re-check when the OWASP list moves out of beta.

For the protocol-level changes that sit underneath this list, read MCP Security in 2026: What the New Specification Fixed and What It Opened Up.

The Short Version

The OWASP MCP Top 10 gives non-specialists a usable checklist: protect secrets, limit permissions, vet tools and dependencies, validate what agents execute, distrust what they read, verify identity, log everything, inventory servers and keep data separate. It is a beta list, so use it as a question sheet instead of a certification.

To scope an agent with clear limits, see our AI governance checklist and our work on custom AI agents.

For the full buyer's checklist, read our whitepaper on MCP and AI agent security.

Related Insights

• MCP Security in 2026: What the New Specification Fixed and What It Opened Up
• FTC Probes AI Labs Over Rogue Agents: What to Do
• NVIDIA OpenShell and Vera Rubin: What GTC Berlin 2026 Means for AI Agents

Sources

• OWASP, MCP Top 10 project (beta, 2025 edition labels)