Owasp MCP — Agent Skill by Microsoft

From the author

OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The owasp-mcp skill provides a comprehensive, machine-readable reference for the OWASP MCP Top 10 (2025). It is designed to help developers and security professionals identify, assess, and remediate common security vulnerabilities inherent in Model Context Protocol architectures. By structuring these risks into standardized documents, the skill enables AI agents to perform security audits, provide defensive guidance, and suggest remediation strategies for issues ranging from credential mismanagement to tool poisoning and shadow server deployment.

What it does

Provides a structured index of the OWASP MCP Top 10 security vulnerabilities.
Offers detailed descriptions, impact assessments, and vulnerability checklists for each risk.
Supplies defensive design patterns and prevention controls for MCP architectures.
Includes realistic attack scenarios to help visualize potential exploitation paths.
Provides actionable detection signals and remediation steps for security incidents.

When to use it

During the design phase of an MCP server or client to implement secure-by-design principles.
When auditing an existing MCP implementation for potential security gaps.
To train or prompt an AI agent to assist in identifying security risks within an MCP-based workflow.
When responding to a suspected security incident involving MCP tool calls or context sharing.

Advantages

Aligned with industry-standard OWASP security research.
Structured for machine-readability, making it ideal for AI-assisted security analysis.
Covers a broad spectrum of risks specific to the Model Context Protocol ecosystem.
Provides clear, actionable remediation guidance for developers.

Usage examples

“What are the security risks associated with tool poisoning in an MCP environment?”: The agent will reference the MCP03:2025 documentation to explain the risks of tool poisoning, provide a checklist for identifying vulnerable configurations, and suggest prevention controls.
“How can I prevent secret exposure in my MCP server implementation?”: The agent will retrieve the MCP01:2025 reference to outline best practices such as using secure vaults, enforcing short-lived tokens, and implementing log redaction.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/owasp-mcp/download
Unzip it into the cross-client skills folder of your project:
```
mkdir -p .agents/skills && unzip owasp-mcp.zip -d .agents/skills
```

Documentation by Microsoft

OWASP® MCP Top 10 — Skill Entry

This SKILL.md is the entrypoint for the MCP Vulnerabilities skill.

The skill encodes the OWASP MCP Top 10 (2025) as structured, machine-readable references that an agent can query to identify, assess, and remediate MCP security risks.

Normative references (MCP Top 10)

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the MCP Top 10 normative documents.
- 00-vulnerability-index.md — index of all vulnerability identifiers, severities, and cross-references.
- 01 through 10 — one document per vulnerability aligned with OWASP MCP numbering.

Third-Party Attribution

Copyright © OWASP Foundation. OWASP® MCP Top 10 content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://owasp.org/www-project-mcp-top-10/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.

Files

ATTRIBUTION.mdAdded by AutoGineer973 B
LICENSEAdded by AutoGineer17.9 KiB
SKILL.md2.5 KiB
references/00-vulnerability-index.md2.7 KiB
references/01-token-mismanagement-secret-exposure.md3.8 KiB
references/02-privilege-escalation-scope-creep.md3.7 KiB
references/03-tool-poisoning.md3.9 KiB
references/04-supply-chain-attacks-dependency-tampering.md4.0 KiB
references/05-command-injection-execution.md4.4 KiB
references/06-prompt-injection-contextual-payloads.md3.8 KiB
references/07-insufficient-authentication-authorization.md4.1 KiB
references/08-lack-of-audit-telemetry.md4.1 KiB
references/09-shadow-mcp-servers.md4.1 KiB
references/10-context-injection-over-sharing.md3.6 KiB

ATTRIBUTION.md

Attribution

This folder is an unmodified copy of the Agent Skill "owasp-mcp", distributed by AutoGineer (https://autogineer.com/agent-skills).

Source: https://github.com/microsoft/hve-core/tree/f425e943bf228052a23e6bc4810b5faef030314f/.github/skills/security/owasp-mcp
Commit: f425e943bf228052a23e6bc4810b5faef030314f
Published by: Microsoft (https://github.com/microsoft)
Publisher: Microsoft (https://github.com/microsoft)
Licence: Creative Commons Attribution-ShareAlike 4.0 International (https://spdx.org/licenses/CC-BY-SA-4.0.html)
Licence evidence: declared in the frontmatter ("license: CC-BY-SA-4.0")
Retrieved: 2026-11-07

The skill's own files are unmodified copies. AutoGineer is not affiliated with or endorsed by the author or the publisher.

Files added by AutoGineer

ATTRIBUTION.md: this file, written by AutoGineer
LICENSE: the SPDX text of CC-BY-SA-4.0 (spdx/license-list-data v3.29.0 (31ba1a50e5397e00a304dbadc76531740e89ee48))

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter, Needs an MCP server

Security

What our scanner noticed· Medium risk

References to credential files

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download owasp-mcp.zip