Name and explain three distinct categories from the OWASP MCP Top 10 (2025). For each, describe the specific MCP attack vector and one mitigation.
Free · 2 AI evals / day
The **OWASP MCP Top 10** is a 2025 risk taxonomy for the Model Context Protocol. It catalogs the ways an MCP setup can be attacked, the same way OWASP's classic Top 10 does for web apps.
Pick three categories. Tool poisoning is when a server hides malicious instructions inside a tool's description text. The model reads that text when deciding whether to call the tool, so the hidden instructions can steer it into doing something unsafe. The fix is to show the full description in the approval screen and to vet the server first.
A rug pull is when a server shows you a harmless tool, you approve it, and then the server silently swaps in a dangerous definition. No new approval is asked for. The fix is to re-verify a tool's definition after any change, ideally with a signature.
A confused deputy is when a server uses broader credentials than you granted, often through a sloppy OAuth flow. The fix is scoped, least-privilege tokens per user. Across all three, the theme is the same: vet servers, require human approval, and give each tool only the access it truly needs.
The **OWASP MCP Top 10** maps MCP's attack surface onto familiar agent threats. I'll name three.
First is tool poisoning. A malicious server embeds adversarial instructions in a tool's description field. The model reads descriptions to decide which tool to call. So the hidden text becomes prompt injection that can trigger unauthorized actions. The defense is host-side sanitization plus showing the full description in the approval UI, and vetting servers before install.
Second is the rug pull. A server passes review with a benign tool definition. Later it silently mutates that definition after approval. No re-approval fires, so the user keeps trusting a changed tool. The defense is cryptographic signing of definitions and periodic re-review of cached approvals.
Third is the confused deputy. A server acts with broader privileges than the user authorized, usually via OAuth misconfiguration such as a missing PKCE check. The defense is enforcing PKCE and issuing minimum-privilege, per-user scoped tokens.
The unifying defenses are least privilege, human approval, server vetting, scoped tokens, and definition pinning. None of these are generic web bugs. Each exploits an MCP primitive: the tool description, the approval flow, or the authorization layer.
Quick reference
TL;DR
MCP's risk surface maps onto OWASP-style agent threats: poisoned tool descriptions, silent rug pulls, and confused-deputy auth. Defenses are vetting, signing, re-approval, and scoped least-privilege tokens.
Imagine hiring a contractor who hands you a list of jobs they can do. You read the list and decide what to let them do. Tool poisoning is when the contractor writes secret instructions in the fine print that trick you into approving more than you meant. A rug pull is when they show you a safe job list, you sign off, then they swap it for a dangerous one without telling you. A confused deputy is when the contractor uses your master key to open rooms you never said they could enter. The fixes are common sense: read the whole list, re-check it after any change, give the contractor only the keys to the rooms they actually need, and only hire contractors you trust.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
A purely local single-user MCP setup with one hand-written trusted server The supply-chain and rug-pull threat models assume third-party or remote servers; a self-authored local server narrows the surface, though poisoning and excessive agency still apply.
An interview question that asks only for a generic web security taxonomy The OWASP MCP Top 10 is protocol-specific; framing it as classic web OWASP misses the agent-layer vectors the question targets.
Pre-2025 MCP discussions before the taxonomy existed The OWASP MCP Top 10 was published in 2025, so citing it as the framework for earlier work is anachronistic and signals weak recency.
Quick scan · 2–4 min
Everything important, quickly.
5 min: name three distinct categories, the MCP mechanism each exploits, one defense per category, then the through-line that the host owns trust enforcement because the protocol does not sandbox.
Real products, models, and research that use this idea.
1Anthropic's MCP authorization spec adopted OAuth 2.1 with mandatory PKCE in 2025 to close confused-deputy gaps on remote servers.
2The ETDI (Enhanced Tool Definition Interface) proposal adds cryptographic signing of tool definitions to defeat rug-pull mutations.
3mcp-inspector and host approval UIs in Claude Desktop and Cursor surface full tool descriptions so poisoned metadata is visible before approval.
4The OWASP GenAI project published the MCP Top 10 in 2025 alongside its OWASP Top 10 for LLM Applications taxonomy.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QWhy is full-description display in the approval UI not a complete defense against tool poisoning?
Sign in or go Pro to see the approach for this follow-up.
QHow does cryptographic signing actually stop a rug pull, and what does it not stop?
Sign in or go Pro to see the approach for this follow-up.
QWhere should sandboxing for MCP servers live, given the spec does not enforce it?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Listing generic web vulnerabilities like SQL injection instead of MCP-specific risks. The auditor wants attack vectors that exploit MCP primitives such as tool descriptions, the approval flow, or the OAuth layer.