Identifies, assesses, and remediates Model Context Protocol security risks using the OWASP MCP Top 10.
npx skills add https://github.com/microsoft/hve-core --skill owasp-mcp
Please help me install this Agent Skill. Skill: owasp-mcp Source: https://github.com/microsoft/hve-core/tree/main/.github/skills/security/owasp-mcp Command: npx skills add https://github.com/microsoft/hve-core --skill owasp-mcp
Teams deploying Model Context Protocol servers and agents lack a structured way to identify and remediate MCP-specific security risks such as token leakage, tool poisoning, prompt injection, and shadow servers.
Review my MCP server configuration against the OWASP MCP Top 10 and list any vulnerabilities with remediation steps.
High-intent search queries and answers about installing and using this skill.
The OWASP MCP Top 10 (2025) is a ranked list of the most critical security risks for Model Context Protocol systems, covering issues from token mismanagement (MCP01) to context injection and over-sharing (MCP10). Each entry includes impact, checklists, controls, and remediation guidance.
Use the vulnerability checklists in each reference document to evaluate your MCP deployment against risks like hard-coded tokens, missing mTLS, unsigned schemas, and unregistered shadow servers. Each checklist maps to concrete prevention controls and detection signals.
Treat retrieved context as untrusted data: sanitize metadata, enforce instruction precedence, track provenance, and require human approval for sensitive tool calls. Constrain model output to structured formats validated against schemas.
Shadow MCP servers are unapproved MCP deployments operating outside formal security governance, often with default credentials and permissive configurations. They bypass centralized authentication and monitoring, creating unmonitored endpoints vulnerable to exploitation and data exfiltration.
No, it is a knowledge base of structured reference documents rather than a scanning tool. An agent queries the references to identify risks, apply checklists, and recommend remediation, but it does not execute scans or runtime detection itself.
overtimepogDiagnose greyhatcc plugin installation, configuration, dependency, and MCP server health issues.
ByronWilliamsCPAEvaluate implementation phase readiness by analyzing deliverables and running quality gates.
YukiIto1999Detect cryptomining activity across AWS workloads using GuardDuty, VPC Flow Logs, and runtime signals.
wizelineMap security controls to compliance frameworks and generate audit evidence.
