github.comrepoOWASP/MCP-Security-Testing-Guide
OWASP MCP Security Testing Guide is a living, GPL-3.0 collection treating the Model Context Protocol as a security boundary from user through model, MCP client, MCP server and tool to the target system. It covers threats, secure development, host/client controls, supply chain, enterprise gateways, detection, incident response, taxonomy, public incidents, case studies and review checklists, with 79 tests in Chapter 3 (sections 3.1–3.19). It includes a finding template, and it links the MCP Goat lab for safe practice. It is useful to AppSec, red team and SOC people assessing MCP deployments.
TL;DR OWASP's living guide to testing and securing MCP deployments, with 79 tests, controls, detection, IR and checklists.
Technologies named here
- MCP Goat
- Finding template and Appendix C
- Model Context Protocol
- LLM
- OWASP
Techniques named here
- MCP security testing
- Detection and incident response for MCP
- MCP supply chain security review
- Enterprise gateway controls for MCP
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle