Describe three categories from the OWASP MCP Top 10 and what risks they codify

Short answer·Hard·4.0 · 0·~3 min·Asked atHarvey·Relevant atAnthropic

Attempt it

Name and explain three distinct categories from the OWASP MCP Top 10. For each, describe the specific MCP attack vector and one mitigation.

Free · 2 AI evals / day

The **OWASP MCP Top 10** is a 2025 risk taxonomy for the Model Context Protocol. It catalogs how an MCP setup can be attacked, as OWASP's classic Top 10 does for web apps. Tool poisoning is when a server hides malicious instructions inside a tool's description text. The model reads that text when deciding whether to call the tool, so the hidden instructions can steer it into doing something unsafe. The fix is to show the full description in the approval screen and to vet the server first. Privilege escalation via scope creep is when a server's permissions grow over time until it can do far more than its job needs. The fix is scoped, least-privilege tokens per user, reviewed regularly. A supply chain attack is when a server package or one of its dependencies is compromised. A rug pull fits here: a server shows you a harmless tool, you approve it, then it silently swaps in a dangerous definition. The fix is to install only vetted servers, pin versions, and re-verify a tool's definition after any change, ideally with a signature. Across all three: vet servers, require human approval, and give each tool only the access it truly needs.

The **OWASP MCP Top 10** is a beta list with 2025 entries that maps MCP's attack surface onto familiar agent threats. Three entries stand out. First is tool poisoning (MCP03). A malicious server embeds adversarial instructions in a tool's description field. The model reads descriptions to decide which tool to call. So the hidden text becomes prompt injection that can trigger unauthorized actions. The defense is host-side sanitization plus showing the full description in the approval UI, and vetting servers before install. Second is privilege escalation via scope creep (MCP02). Temporary or loosely defined server permissions grow over time, so an agent ends up with broader access than the user authorized. The defense is issuing minimum-privilege, per-user scoped tokens and reviewing granted scopes. Third is software supply chain attacks and dependency tampering (MCP04). A compromised server package or dependency changes agent behavior. A rug pull, where a server silently mutates an approved tool definition, fits here. The defense is allowlisting vetted servers, pinning versions, signing definitions, and re-approving on any change. Rug pulls and the confused deputy are real attacks, but neither has its own entry. The unifying defenses are least privilege, human approval, server vetting, scoped tokens, and definition pinning. None of these risks are generic web bugs. Each exploits an MCP primitive: the tool description, the permission scope, or the third-party server code.

TL;DR

Three OWASP MCP Top 10 entries: tool poisoning (MCP03), privilege escalation via scope creep (MCP02) and supply chain tampering (MCP04). Defenses are vetting, signing, re-approval and scoped least-privilege tokens.

Memory aid

Easy to grasp

Imagine hiring a contractor who hands you a list of jobs they can do. You read the list and decide what to let them do. Tool poisoning is when the contractor writes secret instructions in the fine print that trick you into approving more than you meant. Scope creep is when the contractor collects spare keys over the months until they can open rooms you never meant to share. A supply chain attack is when the parts the contractor uses come from a tampered supplier, or when they swap the job list for a dangerous one after you sign. The fixes are common sense: read the whole list, re-check it after any change, give the contractor only the keys to the rooms they actually need, and only hire contractors you trust.

Key concepts

Tool poisoning Confused deputy Prompt injection Least privilege

Concept explanation~2 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

The OWASP MCP Top 10 (a beta list with 2025 entries) is a structured risk taxonomy for the Model Context Protocol. It exists because MCP standardizes the integration boundary between a host and external servers, but it deliberately pushes trust and security enforcement up to the host. The protocol does not sandbox servers, does not authenticate tool authors at the protocol level, and does not re-approve mutated definitions on its own. That design choice creates a specific, namable attack surface, and the taxonomy gives engineers a shared vocabulary for it.

A weak answer lists generic web bugs, or famous attack names such as rug pull and confused deputy that are not entries. A strong answer names entries that exploit actual MCP primitives (the tool description field, server permission scopes, and third-party server code), then pairs each with a defense. The unifying mental model is borrowed from the OWASP Top 10 for LLM Applications: prompt injection and excessive agency are the parent risks, and MCP is a new delivery channel for them. Tool poisoning is prompt injection through metadata. Scope creep is excessive agency built up through permissions.

The main entries fall into three families: definition manipulation, privilege abuse, and supply chain. One entry from each family gives three distinct categories with distinct vectors, not three rephrasings of one idea.

Family one: tool definition manipulation

The first family attacks the metadata the model reads when choosing tools. The model does not just see tool names; it reads the description fields to decide whether and how to call a tool. That makes descriptions an injection channel.

Tool poisoning (MCP03) is the base case. A malicious server embeds adversarial instructions in a tool description, for example, hidden text that says to exfiltrate a file or call a second tool. The model treats the description as trustworthy context and follows it. This is classic prompt injection delivered through MCP metadata rather than through user input.

Cross-server shadowing is the multi-server variant, though it has no entry of its own. When several servers are connected at once, a malicious server can register a tool whose name or description overrides a legitimate server's tool, so calls intended for the trusted tool get hijacked. The model has no reliable way to tell which server it is really talking to, which is why naming and provenance have to be enforced by the host.

The defenses cluster: display the full, untruncated description in the approval UI so a human can spot injected instructions, sanitize and length-limit descriptions host-side, namespace tools per server to block shadowing, and vet servers before installing them. Display alone is weak, because users skim approvals and a long description can bury an injected line. So display has to be paired with sanitization and provenance signals. Treat all description text as untrusted input, never as instructions, the same discipline you would apply to any user-supplied string that reaches the model.

Rug pulls: manipulation across time

Family two: privilege and authorization

Family three: supply chain and isolation

Putting it together

Situations where this technique stops working.

2–4 min · Everything important, quickly.

Risk	MCP mechanism exploited	Primary defense
Tool poisoning (MCP03)	Tool description field read at selection	Full-description approval UI, sanitization, vetting
Privilege escalation via scope creep (MCP02)	Tool granted more capability than the task	Least privilege, scope reviews, human approval on side effects
Supply chain attacks (MCP04)	Compromised server package or dependency	Server allowlist, version pinning, signed definitions
Rug pull (no entry; supply chain and poisoning guidance)	Silent post-approval definition change	Signed definitions, re-approval on change
Confused deputy (no entry)	OAuth proxy consent bypass	Per-client consent, exact redirect URI matching
Cross-server shadowing (no entry)	Malicious server overrides a trusted tool	Tool namespacing, server allowlisting

Real products, models, and research that use this idea.

The MCP authorization spec adopted OAuth 2.1 with mandatory PKCE in 2025, and its security guidance requires per-client consent at proxy servers against the confused deputy.
The ETDI (Enhanced Tool Definition Interface) proposal adds cryptographic signing of tool definitions to defeat rug-pull mutations.

What an interviewer would ask next. Try answering before peeking at the approach.

QWhy is full-description display in the approval UI not a complete defense against tool poisoning?

Users skim approvals and long descriptions hide injections; pair display with host-side sanitization, length limits, and provenance signals, and treat description text as untrusted input.

2 more follow-ups an interviewer would ask next. Sign in to reveal them.

Red flags & common mistakes

The phrases that signal junior thinking. Click to expand.

Most common mistake

Listing generic web vulnerabilities, or famous attack names such as rug pull and confused deputy that have no entry, instead of actual entries. Strong picks exploit MCP primitives such as tool descriptions, permission scopes or third-party server code.

60 second bullets to scan on the way to the call.

Three named OWASP MCP Top 10 categories that differ from each other
The specific MCP mechanism each attack exploits

Primary sources. Browse if you want the original framing.