🔐

MCP Server Security Audit

Audit an MCP server against the OWASP MCP Top 10. Nine questions, a graded score, and a concrete remediation list.

OWASP MCP TOP 10

The CalculatorPage 1

Server name

Only used to label the report.

TICK WHAT IS TRUE OF THIS SERVER

☐Authentication on every requestAPI key or OAuth bearer token, rejected at the edge.

☐Credentials hardcoded in source or configThey leak into logs, model memory and repository history.

☐Untrusted input interpolated into commands or queriesModel output reaching a shell or a raw query string.

☑Reads or writes files from model-supplied pathsWithout confinement to an allow-listed root.

☑Spawns shell commands or processesExpands the blast radius of any prompt-injection success.

☑Runs over local STDIO transportExecutes commands with no sanitisation or execution boundary.

☐Published with build provenance attestationVerifiable build chain, so a compromised publish is detectable.

☐Outbound network destinations restrictedBlocks exfiltration and SSRF to metadata endpoints.

FDo not deploy

6 findings · 1 critical · 3 high
−85 points deducted

CRITICALInsufficient Authentication & AuthorizationMCP01

No authentication enforced. The MCP SDK ships no built-in auth — it is entirely the implementer’s responsibility.

Fix: Require an API key or OAuth bearer token on every request; reject anonymous calls at the edge.

HIGHPath TraversalMCP04

File paths come from model output without confinement. 82% of surveyed implementations are exposed to this.

Fix: Resolve every path against a fixed allow-listed root and reject anything that escapes it.

HIGHArbitrary Code Execution SurfaceMCP05

The server spawns processes, expanding the blast radius of any prompt-injection success.

Fix: Drop privileges, sandbox the child process, and allow-list the executables that may be invoked.

HIGHSTDIO Supply-Chain ExposureMCP06

Local STDIO transport executes commands with no sanitization or execution boundary. Anthropic confirmed this behaviour is intentional and declined to change the protocol. Hosted/remote servers are not affected.

Fix: Prefer a hosted Streamable HTTP endpoint where one exists; otherwise pin versions and audit every installed server.

MEDIUMMissing Build ProvenanceMCP07

The package ships without verifiable build-chain attestation, so a compromised publish would be undetectable.

Fix: Publish via GitHub Actions trusted publishing and attach provenance attestations.

MEDIUMUnrestricted Network EgressMCP08

Outbound destinations are unrestricted, enabling data exfiltration and SSRF.

Fix: Allow-list outbound hosts; block link-local and metadata endpoints explicitly.

OWASP MCP TOP 10 — REFERENCE

ID	OWASP risk	Checked here as	Status
MCP01	Token Mismanagement & Secret Exposure	hardcoded credentials	clear
MCP02	Privilege Escalation via Scope Creep	—	not covered
MCP03	Tool Poisoning	—	not covered
MCP04	Software Supply Chain Attacks	STDIO transport · build provenance	finding
MCP05	Command Injection & Execution	command construction · process spawning	finding
MCP06	Intent Flow Subversion	—	not covered
MCP07	Insufficient Authentication & Authorization	auth on every request	finding
MCP08	Lack of Audit & Telemetry	—	not covered
MCP09	Shadow MCP Servers	—	not covered
MCP10	Context Injection & Over-sharing	file-path confinement · network egress	finding

The eight questions map onto five of the ten OWASP categories. Privilege escalation via scope creep, tool poisoning, intent flow subversion, shadow servers and context over-sharing are architectural concerns that cannot be established from a self-assessment questionnaire, so they are marked not covered rather than clear. Note also that the finding IDs on the cards above are this audit’s own numbering — they share the MCP prefix with OWASP’s IDs but do not mean the same thing, which is why this table maps by meaning rather than by number.

Data Source & Legal Disclaimer

Effective: Control set reviewed 2026-09

Sources: OWASP MCP Top 10 (2026) · MCP specification security guidance · public CVE data Jan–Feb 2026

This is a self-assessment checklist, not a penetration test. It reflects the answers you give and cannot detect a vulnerability you are unaware of. Treat a high score as 'no known misconfiguration in these nine areas', not as proof of security.

See all data sources & update policy →

How it worksPage 2

↩ Back to calculator

30+ CVEs in 60 days — and not one of them was clever

Between January and February 2026 more than thirty CVEs were filed against MCP servers, clients and infrastructure. The striking thing is what they were not: they were not sophisticated zero-days. They were missing authentication, path traversal, command injection and hardcoded credentials — the same four classes that have topped web-application risk lists for a decade. CVE-2026-32211 (Azure MCP Server, CVSS 9.1) had no authentication at all, and no patch was released. The lesson is that MCP servers are being written fast, by people focused on capability rather than threat modelling, and the MCP SDK deliberately provides no authentication layer — it is entirely the implementer’s responsibility. This checklist walks the eight highest-yield questions.

Where an MCP server actually gets attacked

Untrusted input arrives from the model, not from a browser. The model may itself be carrying a prompt injection from a poisoned document, so every value it supplies has to be treated as attacker-controlled — which is why path handling, command construction and auth are the recurring failure points.

A local filesystem server that looks harmless and scores F

A developer installs a community filesystem MCP server over STDIO. It has no auth (it is local, after all), reads paths supplied by the model, and was published straight from a laptop.

MCP07 no auth:−30 — the SDK provides none, and "it is local" is not a control once a prompt injection is involved
MCP04 path traversal:−15 — paths come from model output with no allow-listed root
MCP06 STDIO:−12 — local transport executes commands with no execution boundary
MCP07 provenance:−8 — no build attestation, so a compromised republish would be invisible
Result:35/100 — grade F, verdict do not deploy

↩ Back to calculator

MCP Server Security Audit

30+ CVEs in 60 days — and not one of them was clever

Keep the Free Edition Free