Analysis · curated 25 Jul 2026
MCP Security - OWASP Cheat Sheet Series
First reported owasp.org
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
The OWASP MCP Security Cheat Sheet gives defenders a consolidated reference for the novel risks of agentic tool-calling via MCP, mapping each threat class to concrete mitigations for securing clients, servers, and their connections.
The OWASP MCP Security Cheat Sheet catalogs the attack surface introduced by Anthropic's Model Context Protocol, which lets LLM agents dynamically invoke external tools. It enumerates key risk classes—tool poisoning, rug pull attacks, tool shadowing/cross-origin escalation, confused deputy, data exfiltration via legitimate channels, over-scoped tokens, supply chain attacks, message tampering/replay, and sandbox escapes—alongside best practices such as least privilege and scoped per-server credentials.