Name and explain three distinct categories from the OWASP MCP Top 10 (2025). For each, describe the specific MCP attack vector and one mitigation.
MCP's risk surface maps onto OWASP-style agent threats: poisoned tool descriptions, silent rug pulls, and confused-deputy auth. Defenses are vetting, signing, re-approval, and scoped least-privilege tokens.
Imagine hiring a contractor who hands you a list of jobs they can do. You read the list and decide what to let them do. Tool poisoning is when the contractor writes secret instructions in the fine print that trick you into approving more than you meant. A rug pull is when they show you a safe job list, you sign off, then they swap it for a dangerous one without telling you. A confused deputy is when the contractor uses your master key to open rooms you never said they could enter. The fixes are common sense: read the whole list, re-check it after any change, give the contractor only the keys to the rooms they actually need, and only hire contractors you trust.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
The OWASP MCP Top 10, published in 2025 under the OWASP GenAI project, is a structured risk taxonomy for the Model Context Protocol. It exists because MCP standardizes the integration boundary between a host and external servers, but it deliberately pushes trust and security enforcement up to the host. The protocol does not sandbox servers, does not authenticate tool authors at the protocol level, and does not re-approve mutated definitions on its own. That design choice creates a specific, namable attack surface, and the taxonomy gives interviewers a shared vocabulary for probing whether a candidate understands it.
This question is hard because it rewards precision. A weak answer lists generic web bugs. A strong answer names categories that exploit actual MCP primitives, the tool description field, the approval flow, the multi-server fan-out, and the OAuth authorization layer, then pairs each with a defense. The unifying mental model is borrowed from the OWASP Top 10 for LLM Applications: prompt injection and excessive agency are the parent risks, and MCP is just a new delivery channel for them. Tool poisoning is prompt injection through metadata. The confused deputy is excessive agency expressed through OAuth scope. Naming that lineage out loud signals seniority.
This deep dive walks through the main categories, groups them into three families, definition manipulation, privilege abuse, and supply chain, and gives the defense for each so you can answer with structure rather than a flat list. The structure also matters because the rubric checks for three distinct categories with distinct vectors, not three rephrasings of one idea.
Family one: tool definition manipulation
The first family attacks the metadata the model reads when choosing tools. The model does not just see tool names; it reads the description fields to decide whether and how to call a tool. That makes descriptions an injection channel.
Tool poisoning is the base case. A malicious server embeds adversarial instructions in a tool description, for example, hidden text that says to exfiltrate a file or call a second tool. The model treats the description as trustworthy context and follows it. This is classic prompt injection delivered through MCP metadata rather than through user input.
Cross-server shadowing is the multi-server variant. When several servers are connected at once, a malicious server can register a tool whose name or description overrides a legitimate server's tool, so calls intended for the trusted tool get hijacked. The model has no reliable way to tell which server it is really talking to, which is why naming and provenance have to be enforced by the host.
The defenses cluster: display the full, untruncated description in the approval UI so a human can spot injected instructions, sanitize and length-limit descriptions host-side, namespace tools per server to block shadowing, and vet servers before installing them. A subtle point worth raising in an interview is that display alone is weak, because users skim approvals and a long description can bury an injected line. So display has to be paired with sanitization and provenance signals. Treat all description text as untrusted input, never as instructions, the same discipline you would apply to any user-supplied string that reaches the model.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
| OWASP MCP risk | MCP mechanism exploited | Primary defense |
|---|---|---|
| Tool poisoning | Tool description field read at selection | Full-description approval UI, sanitization, vetting |
| Rug pull | Silent post-approval definition change | Signed definitions, re-approval on change |
| Confused deputy | OAuth scope, missing PKCE | PKCE enforcement, per-user scoped tokens |
| Cross-server shadowing | Malicious server overrides a trusted tool | Tool namespacing, server allowlisting |
| Excessive agency | Tool granted more capability than the task | Least privilege, human approval on side effects |
Real products, models, and research that use this idea.
- Anthropic's MCP authorization spec adopted OAuth 2.1 with mandatory PKCE in 2025 to close confused-deputy gaps on remote servers.
- The ETDI (Enhanced Tool Definition Interface) proposal adds cryptographic signing of tool definitions to defeat rug-pull mutations.
What an interviewer would ask next. Try answering before peeking at the approach.
QWhy is full-description display in the approval UI not a complete defense against tool poisoning?
Users skim approvals and long descriptions hide injections; pair display with host-side sanitization, length limits, and provenance signals, and treat description text as untrusted input.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Listing generic web vulnerabilities like SQL injection instead of MCP-specific risks. The auditor wants attack vectors that exploit MCP primitives such as tool descriptions, the approval flow, or the OAuth layer.
60 second bullets to scan on the way to the call.
Three named OWASP MCP Top 10 categories that differ from each other
The specific MCP mechanism each attack exploits
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.