Describe three categories from the OWASP MCP Top 10 and what risks they codify

The **OWASP MCP Top 10** is a 2025 risk taxonomy for the Model Context Protocol. It catalogs the ways an MCP setup can be attacked, the same way OWASP's classic Top 10 does for web apps. Pick three categories. Tool poisoning is when a server hides malicious instructions inside a tool's description text. The model reads that text when deciding whether to call the tool, so the hidden instructions can steer it into doing something unsafe. The fix is to show the full description in the approval screen and to vet the server first. A rug pull is when a server shows you a harmless tool, you approve it, and then the server silently swaps in a dangerous definition. No new approval is asked for. The fix is to re-verify a tool's definition after any change, ideally with a signature. A confused deputy is when a server uses broader credentials than you granted, often through a sloppy OAuth flow. The fix is scoped, least-privilege tokens per user. Across all three, the theme is the same: vet servers, require human approval, and give each tool only the access it truly needs.

The **OWASP MCP Top 10** maps MCP's attack surface onto familiar agent threats. I'll name three. First is tool poisoning. A malicious server embeds adversarial instructions in a tool's description field. The model reads descriptions to decide which tool to call. So the hidden text becomes prompt injection that can trigger unauthorized actions. The defense is host-side sanitization plus showing the full description in the approval UI, and vetting servers before install. Second is the rug pull. A server passes review with a benign tool definition. Later it silently mutates that definition after approval. No re-approval fires, so the user keeps trusting a changed tool. The defense is cryptographic signing of definitions and periodic re-review of cached approvals. Third is the confused deputy. A server acts with broader privileges than the user authorized, usually via OAuth misconfiguration such as a missing PKCE check. The defense is enforcing PKCE and issuing minimum-privilege, per-user scoped tokens. The unifying defenses are least privilege, human approval, server vetting, scoped tokens, and definition pinning. None of these are generic web bugs. Each exploits an MCP primitive: the tool description, the approval flow, or the authorization layer.