Request: Add MCP (Model Context Protocol) Attack Category to OWASP LLM Top 10

[SyedAnas01]

Request: MCP Attack Category Coverage in OWASP LLM Top 10

Background

Model Context Protocol (MCP) servers represent an emerging attack surface that the current OWASP LLM Top 10 doesn't explicitly address. MCP is now the standard protocol connecting Claude, GitHub Copilot, Cursor, and 500+ AI tools to external capabilities.

Why This Matters

MCP servers introduce a distinct set of vulnerabilities not captured by existing OWASP LLM Top 10 categories:

1. Tool Output Injection (extension of LLM01 - Prompt Injection): Malicious content in tool outputs that modifies AI behavior — distinct from web-based prompt injection in that it occurs at the protocol layer, not the content layer.

2. Credential Exposure via Tool Response (new category): MCP servers handling API keys, tokens, and credentials expose these through tool responses in ways visible to the LLM context — creating credential harvesting via reflective tool calls.

3. Cross-Server Context Poisoning (new attack primitive): A compromised MCP server injecting content that affects other MCP servers sharing the same agent context.

4. Tool Schema Hijacking (extension of LLM07 - Insecure Plugin Design): Malformed JSON Schema definitions that cause agents to invoke unintended tool combinations.

Evidence of the Problem

We audited 50+ production MCP servers using mcp-safeguard (first automated MCP security scanner, MIT license):

• 46% had High or Critical findings
• 14% had credential exposure
• 62% had SSRF-enabling URL patterns

Proposed Action

Request that the next OWASP LLM Top 10 revision explicitly address:

1. MCP-specific attack vectors
2. Tool poisoning at the schema level (distinct from model-level)
3. Agentic context contamination

Reference

• mcp-safeguard (scanner with 52 MCP-specific detection rules): https://github.com/SyedAnas01/mcp-safeguard
• Technical report: https://gist.github.com/SyedAnas01/9279734256021c8f1af048a38c46877e
• MCP Specification: https://modelcontextprotocol.io

Interested in contributing to this effort if the OWASP LLM project is open to collaboration.

— Syed Anas Mohiuddin, Security Researcher, Cognivators

[dnyandeobharambe]

This is exactly the gap I've been working on. Built working implementations of all 10 OWASP MCP Top 10 patterns — each with attack demos showing the vulnerability and deterministic defenses blocking it.
The four attack categories you've identified map directly to patterns in the repo:

• Tool Output Injection → MCP03 Content Sanitization
• Credential Exposure via Tool Response → MCP01 Credential Isolation
• Cross-Server Context Poisoning → MCP10 Context Scoping
• Tool Schema Hijacking → MCP09 Tool Registry
  Happy to contribute these as reference implementations if the project moves forward.
  github.com/dnyandeobharambe/mcp-security-patterns