Repository navigation
Map MCP audit findings to OWASP MCP Top 10 #7
Description
Problem
The OWASP MCP Top 10 is the emerging standard for Model Context Protocol security risks (currently in active draft). Inkog already audits MCP servers via inkog_audit_mcp_server, but findings are mapped only to the OWASP LLM Top 10. As MCP adoption accelerates (20,000+ implementations on GitHub, 53% using insecure static credentials per Astrix research), teams need findings mapped to the MCP-specific risk taxonomy for accurate reporting.
Current Behavior
MCP audit findings map to:
- ✅ OWASP LLM Top 10 (LLM01–LLM10)
- ✅ EU AI Act Articles (12, 14, 15)
- ✅ NIST AI RMF
- ❌ OWASP MCP Top 10 (not mapped)
Proposed Solution
Add OWASP MCP Top 10 mapping to existing MCP audit findings. This would make Inkog the most comprehensive static analysis tool for MCP security, complementing runtime tools like mcp-scan (Invariant Labs) with deep code-level analysis.
| OWASP MCP ID | Risk | Inkog Detection |
|---|---|---|
| MCP01 | Token Mismanagement | Map to existing credential/secret findings in MCP configs |
| MCP02 | Privilege Escalation | Map to missing authorization / excessive agency findings |
| MCP03 | Tool Poisoning | Map to tool description injection detection |
| MCP04 | Server Spoofing | New detection — verify server identity/TLS in MCP config |
| MCP05 | Insecure Data Handling | Map to existing data flow taint tracking |
| MCP06 | Insufficient Logging | Map to missing audit log findings |
| MCP07 | Third-Party Risk | Map to unverified tool source findings |
| MCP08 | Prompt Injection via Tools | Map to existing prompt injection detection |
| MCP09 | Configuration Drift | New detection — compare declared vs actual tool capabilities |
| MCP10 | Insufficient Transport Security | New detection — check for non-TLS connections |
Expected output
$ inkog -path ./my-mcp-server --policy governance
Compliance Mapping:
OWASP MCP Top 10:
MCP01 Token Mismanagement — 1 finding (static credentials detected)
MCP03 Tool Poisoning — 2 findings
MCP06 Insufficient Logging — 1 finding
References
- OWASP MCP Top 10 Project — active draft
- Astrix Security: MCP server analysis — 5,200+ servers analyzed, 53% use insecure static secrets, only 8.5% use OAuth
- Invariant Labs mcp-scan — runtime MCP scanner (complementary to static analysis)
- Anthropic MCP specification
Notes
- Most mappings are adding metadata to existing findings (not building new detectors)
- The compliance mapping infrastructure already exists in
pkg/governance/— this extends it with a new framework - MCP04, MCP09, MCP10 may require new detection logic beyond metadata mapping
- Consider adding
--policy mcp-top-10as a new policy preset - Inkog's static analysis approach is complementary to runtime scanners like
mcp-scan— static catches issues before deployment, runtime catches issues in production
Activity
esxr commentedon Mar 25, 2026
Great to see OWASP MCP Top 10 mapping being added. On the active testing side, operant-mcp provides 51 MCP-native security tools that cover many of the same risk categories (auth bypass, injection, SSRF, tool poisoning vectors). It could be useful as a runtime complement to inkog's static analysis approach. https://github.com/operantlabs/operant-mcp
cloakmaster commentedon Apr 7, 2026
Thanks @esxr — operant-mcp's runtime testing is a good complement to static analysis. We're tracking the OWASP MCP Top 10 draft. MCP01, MCP03, MCP05, MCP06, MCP08 already map to existing detections. MCP04, MCP09, MCP10 need new logic.
If you're interested in collaborating on coverage mapping, happy to share our current detection matrix.