| name | owasp-mcp |
| description | OWASP MCP Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in Model Context Protocol environments - Brought to you by microsoft/hve-core. |
| license | CC-BY-SA-4.0 |
| user-invocable | false |
| metadata | {"authors":"OWASP MCP Top 10 Project","spec_version":"1.0","framework_revision":"1.0.0","last_updated":"2026-02-13","skill_based_on":"https://github.com/chris-buckley/agnostic-prompt-standard","content_based_on":"https://owasp.org/www-project-mcp-top-10/"} |
OWASP MCP Top 10 — Skill Entry
This SKILL.md is the entrypoint for the MCP Vulnerabilities skill.
The skill encodes the OWASP MCP Top 10 (2025) as structured, machine-readable references
that an agent can query to identify, assess, and remediate MCP security risks.
Normative references (MCP Top 10)
- 00 Vulnerability Index
- 01 Token Mismanagement and Secret Exposure
- 02 Privilege Escalation via Scope Creep
- 03 Tool Poisoning
- 04 Software Supply Chain Attacks and Dependency Tampering
- 05 Command Injection and Execution
- 06 Prompt Injection via Contextual Payloads
- 07 Insufficient Authentication and Authorization
- 08 Lack of Audit and Telemetry
- 09 Shadow MCP Servers
- 10 Context Injection and Over-Sharing
Skill layout
SKILL.md — this file (skill entrypoint).references/ — the MCP Top 10 normative documents.
00-vulnerability-index.md — index of all vulnerability identifiers, severities, and cross-references.01 through 10 — one document per vulnerability aligned with OWASP MCP numbering.
🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.
