OWASP MCP Top 10 and Spellwarden rules
Last updated 7 November 2026
The OWASP MCP Top 10 is a list of ten security risks for servers and clients of the Model Context Protocol. This page shows, for each entry, the rules of the Spellwarden scanner that are tagged to it. The tags are the scanner's own, as they are in scanner 1.9.1. Nothing on this page adds to them: an entry that no rule is tagged to says so.
About the list
Read on 7 November 2026 at owasp.org/www-project-mcp-top-10: the entries are labelled 2025 and the list is described as a beta release in pilot testing. The names below are the official names of the entries. A final edition may change them.
The scanner's tags are its own mapping of rules to entries, described with the OWASP columns of Scanner rules. A rule can be tagged to more than one entry, and an entry can have no rule.
7 of 10 entries have at least one tagged rule.
The ten entries
MCP01: Token Mismanagement & Secret Exposure
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-011 | Hard-coded credential in the package | Critical |
| SW-MCP-002 | Static key authentication instead of OAuth | Medium |
| SW-CFG-002 | Credential written into an MCP server configuration | Critical |
| SW-CFG-010 | Literal value under a secret name in an MCP server configuration | High |
MCP02: Privilege Escalation via Scope Creep
| Rule | Title | Default severity |
|---|---|---|
| SW-CFG-013 | Database or cluster MCP server with write access although a read-only mode exists | High |
MCP03: Tool Poisoning
| Rule | Title | Default severity |
|---|---|---|
| SW-MCP-011 | Tool description contains instruction-like text | High |
Explainer: MCP tool poisoning.
MCP04: Software Supply Chain Attacks & Dependency Tampering
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-007 | Remote script piped to a shell | High |
| SW-SKL-009 | Unpinned dependency install | Medium |
| SW-SKL-037 | Executable downloaded from a moving reference and run without an integrity check | Medium |
| SW-CFG-003 | MCP server launched from an unpinned package | Medium |
| SW-CFG-009 | Marketplace plugin source not pinned to a commit | Medium |
MCP05: Command Injection & Execution
No rule is tagged to this entry in scanner 1.9.1.
MCP06: Prompt Injection via Contextual Payloads
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-019 | Fetches external URL content into context without an allowlist | Medium |
Explainer: Prompt injection in agent skills.
MCP07: Insufficient Authentication & Authorization
| Rule | Title | Default severity |
|---|---|---|
| SW-MCP-001 | Server lists tools without authentication | High |
| SW-MCP-002 | Static key authentication instead of OAuth | Medium |
| SW-MCP-003 | OAuth dynamic client registration (deprecated; use Client ID Metadata Documents) | Medium |
| SW-MCP-010 | No protected resource metadata, or issuer not validated | Medium |
| SW-CFG-002 | Credential written into an MCP server configuration | Critical |
| SW-CFG-010 | Literal value under a secret name in an MCP server configuration | High |
MCP08: Lack of Audit and Telemetry
No rule is tagged to this entry in scanner 1.9.1.
MCP09: Shadow MCP Servers
| Rule | Title | Default severity |
|---|---|---|
| SW-REG-002 | MCP server not admitted in the organisation's private registry | High |
MCP10: Context Injection & Over-Sharing
No rule is tagged to this entry in scanner 1.9.1.