MCP Release Bot Secrets.ml
SecDim's release-management team runs an internal chat assistant, the Release Bot, that answers questions about build and approval readiness. Behind…
OWASP MCP Top 10 · 2025 edition
OWASP MCP Top 10 Challenges
Train your team against the OWASP MCP Top 10. Developers fix real MCP servers and AI agents that leak tokens, trust poisoned tools and run injected commands, before attackers find the same flaws in production.
Ready when the auditor asks
Generate Your OWASP MCP Top 10 Training Report
Every completed challenge rolls up into a OWASP MCP Top 10 training report. Point and click to generate it, then hand it straight to your auditor, customer or partner the moment they ask for evidence.
Capability, not checkbox compliance
Hands-On Challenges for Every Category
The Model Context Protocol connects AI agents to files, APIs, shells and other services, and the OWASP MCP Top 10, currently in beta, maps where that tool layer breaks. Every challenge below is a working MCP application with a real vulnerability: developers fix it without breaking functionality, and every verified fix becomes reportable evidence of AI security capability.
New to MCP security?
Start the CourseMCP Security for Developers
Work through each MCP attack class, from tool poisoning to supply chain compromise, using documented incidents and proof-of-concept exploits, then apply the controls that stop them.
MCP01:2025
Token Mismanagement & Secret Exposure
Agents and MCP servers that hard-code credentials, hand out over-broad tokens or let secrets slip into logs and model context.
MCP02:2025
Privilege Escalation via Scope Creep
Tools that can do more than their job needs, or that let model-supplied values decide what a caller is allowed to reach.
MCP03:2025
Tool Poisoning
Tampered tool descriptions, look-alike tools and trusted tools that change behaviour, all steering the model toward an attacker’s goal.
MCP04:2025
Software Supply Chain Attacks & Dependency Tampering
A compromised SDK, connector or package running inside the agent’s trusted path, with its data and its privileges.
MCP05:2025
Command Injection & Execution
Tools that build shell commands or queries from model-chosen input, so injected text runs as code on the MCP host.
MCP06:2025
Prompt Injection via Contextual Payloads
Instructions hidden in documents, resources or tool results that the agent obeys as though the user had asked.
MCP07:2025
Insufficient Authentication & Authorization
MCP servers that accept tokens without checking audience or scope, or let one team’s users reach another team’s data.
MCP08:2025
Lack of Audit and Telemetry
Tool calls and data access that leave no reliable record of who did what and when, so misuse goes unnoticed.
MCP09:2025
Shadow MCP Servers
Unapproved MCP servers started from local configuration that receive code and data with nobody governing them.
MCP10:2025
Context Injection & Over-Sharing
Context handed between agents, users or workflows that should stay apart, leaking confidential details and untrusted instructions.
Roll it out
Turn the Standard Into a Training Program
Assign these challenges to your team as learning pathways, track verified fixes, and report OWASP MCP Top 10 coverage to auditors, customers and the board, with evidence, not attendance sheets.