owasp-mcp

OWASP MCP Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in Model Context Protocol environments - Brought to you by microsoft/hve-core.

909 stars

Best use case

owasp-mcp is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

OWASP MCP Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in Model Context Protocol environments - Brought to you by microsoft/hve-core.

Teams using owasp-mcp should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

  • You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

  • You only need a quick one-off answer and do not need a reusable workflow.
  • You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/owasp-mcp/SKILL.md --create-dirs "https://raw.githubusercontent.com/microsoft/hve-core/main/.github/skills/security/owasp-mcp/SKILL.md"

Manual Installation

  1. Download SKILL.md from GitHub
  2. Place it in .claude/skills/owasp-mcp/SKILL.md inside your project
  3. Restart your AI agent — it will auto-discover the skill

How owasp-mcp Compares

Feature / Agentowasp-mcpStandard Approach
Platform SupportNot specifiedLimited / Varies
Context Awareness High Baseline
Installation ComplexityUnknownN/A

Frequently Asked Questions

What does this skill do?

OWASP MCP Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in Model Context Protocol environments - Brought to you by microsoft/hve-core.

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

SKILL.md Source

# OWASP MCP Top 10 — Skill Entry

This `SKILL.md` is the **entrypoint** for the MCP Vulnerabilities skill.

The skill encodes the **OWASP MCP Top 10 (2025)** as structured, machine-readable references
that an agent can query to identify, assess, and remediate MCP security risks.

## Normative references (MCP Top 10)

1. [00 Vulnerability Index](references/00-vulnerability-index.md)
2. [01 Token Mismanagement and Secret Exposure](references/01-token-mismanagement-secret-exposure.md)
3. [02 Privilege Escalation via Scope Creep](references/02-privilege-escalation-scope-creep.md)
4. [03 Tool Poisoning](references/03-tool-poisoning.md)
5. [04 Software Supply Chain Attacks and Dependency Tampering](references/04-supply-chain-attacks-dependency-tampering.md)
6. [05 Command Injection and Execution](references/05-command-injection-execution.md)
7. [06 Prompt Injection via Contextual Payloads](references/06-prompt-injection-contextual-payloads.md)
8. [07 Insufficient Authentication and Authorization](references/07-insufficient-authentication-authorization.md)
9. [08 Lack of Audit and Telemetry](references/08-lack-of-audit-telemetry.md)
10. [09 Shadow MCP Servers](references/09-shadow-mcp-servers.md)
11. [10 Context Injection and Over-Sharing](references/10-context-injection-over-sharing.md)

## Skill layout

- `SKILL.md` — this file (skill entrypoint).
- `references/` — the MCP Top 10 normative documents.
  - `00-vulnerability-index.md` — index of all vulnerability identifiers, severities, and cross-references.
  - `01` through `10` — one document per vulnerability aligned with OWASP MCP numbering.

---

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*

Related Skills

owasp-top-10

909
from microsoft/hve-core

OWASP Top 10 for Web Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in web application environments - Brought to you by microsoft/hve-core.

owasp-llm

909
from microsoft/hve-core

OWASP Top 10 for LLM Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in large language model systems - Brought to you by microsoft/hve-core.

owasp-infrastructure

909
from microsoft/hve-core

OWASP Infrastructure Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in internal IT infrastructure environments - Brought to you by microsoft/hve-core.

owasp-cicd

909
from microsoft/hve-core

OWASP CI/CD Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in continuous integration and continuous delivery environments - Brought to you by microsoft/hve-core.

owasp-agentic

909
from microsoft/hve-core

OWASP Agentic Security Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in AI agent systems - Brought to you by microsoft/hve-core.

pr-reference

909
from microsoft/hve-core

Generates PR reference XML containing commit history and unified diffs between branches with extension and path filtering. Includes utilities to list changed files by type and read diff chunks. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. - Brought to you by microsoft/hve-core

security-reviewer-formats

909
from microsoft/hve-core

Format specifications and data contracts for the security reviewer orchestrator and its subagents - Brought to you by microsoft/hve-core.

secure-by-design

909
from microsoft/hve-core

Secure by Design principles knowledge base for assessing adherence to security-first design, development, and deployment practices across the software lifecycle - Brought to you by microsoft/hve-core.

jira

909
from microsoft/hve-core

Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. - Brought to you by microsoft/hve-core

hve-core-installer

909
from microsoft/hve-core

Decision-driven installer for HVE-Core with 6 clone-based installation methods, extension quick-install, environment detection, and agent customization workflows - Brought to you by microsoft/hve-core

gitlab

909
from microsoft/hve-core

Manage GitLab merge requests and pipelines with a Python CLI - Brought to you by microsoft/hve-core

vscode-playwright

909
from microsoft/hve-core

VS Code screenshot capture using Playwright MCP with serve-web for slide decks and documentation - Brought to you by microsoft/hve-core