MCP challenges mapped to the OWASP MCP Top 10:2025
We now have MCP challenges on SecDim Play, mapped to the OWASP MCP Top 10:2025.
The Model Context Protocol (MCP) connects AI agents to files, APIs, shells and other services. Each challenge is an MCP server or AI agent with a security vulnerability. Your job is to find and fix it without breaking what the app does.
The challenges by OWASP category:
- MCP01 Token Mismanagement & Secret Exposure: MCP Release Bot Secrets.ml
- MCP02 Privilege Escalation via Scope Creep: MCP Privilege Escalation Via Scope Creep.ml
- MCP03 Tool Poisoning: MCP Poison.ai, MCP Execution Hooking.ai, MCP Tool Collision.ai
- MCP04 Software Supply Chain Attacks & Dependency Tampering: MCP Dependency Tampering.ml
- MCP05 Command Injection & Execution: MCP Command Injection and Execution.ml
- MCP06 Prompt Injection via Contextual Payloads: MCP Intent Flow Subversion.ml
- MCP07 Insufficient Authentication & Authorization: MCP Broken Authorization.ml
- MCP08 Lack of Audit and Telemetry: MCP Lack of Auditing and Telemetry.ml
- MCP09 Shadow MCP Servers: MCP Shadow MCP Server.ml
- MCP10 Context Injection & Over-Sharing: MCP Context Injection and Over-Sharing.ml
See the full mapping: OWASP MCP Top 10 (2025) Secure Coding Challenges | SecDim
Play the AI game: Play - SecDim
New to MCP security? Start with the course: MCP Security for Developers | SecDim