owasp-mcp
OWASP MCP Top 10脆弱性ナレッジベース。Model Context Protocol環境におけるセキュリティリスクの特定、評価、修復のためのものです。
npx skills add https://github.com/microsoft/hve-core --skill owasp-mcpOWASP® MCP Top 10 — Skill Entry
This SKILL.md is the entrypoint for the MCP Vulnerabilities skill.
The skill encodes the OWASP MCP Top 10 (2025) as structured, machine-readable references that an agent can query to identify, assess, and remediate MCP security risks.
Normative references (MCP Top 10)
- 00 Vulnerability Index
- 01 Token Mismanagement and Secret Exposure
- 02 Privilege Escalation via Scope Creep
- 03 Tool Poisoning
- 04 Software Supply Chain Attacks and Dependency Tampering
- 05 Command Injection and Execution
- 06 Prompt Injection via Contextual Payloads
- 07 Insufficient Authentication and Authorization
- 08 Lack of Audit and Telemetry
- 09 Shadow MCP Servers
- 10 Context Injection and Over-Sharing
Skill layout
SKILL.md— this file (skill entrypoint).references/— the MCP Top 10 normative documents.00-vulnerability-index.md— index of all vulnerability identifiers, severities, and cross-references.01through10— one document per vulnerability aligned with OWASP MCP numbering.
Third-Party Attribution
Copyright © OWASP Foundation. OWASP® MCP Top 10 content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://owasp.org/www-project-mcp-top-10/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.