OWASP MCP Top 10 (2025) Engineering Checklist & Remediation Reference

Control-by-control reference for auditing Model Context Protocol (mcp.json) configurations against MCP01 through MCP10 with exact JSON diffs and false-positive rules.

1. Why mcp.json Needs Deterministic Static Verification

Model Context Protocol (mcp.json, .cursor/mcp.json, and claude_desktop_config.json) files grant autonomous AI agents direct execution privileges over databases, local filesystems, cloud APIs, and shell environments. A single plaintext API token or unpinned npx -y command exposes developer workstations and CI runners to immediate compromise.

2. Critical Severity Controls (MCP01, MCP02, MCP03, MCP05)

MCP01: Token Mismanagement & Secret Exposure

Never commit raw API keys (sk-proj-..., sk-ant-..., ghp_..., AKIA...) or database credentials inside mcp.json. Replace hardcoded values with environment variable interpolation:

{
  "mcpServers": {
    "prod-postgres": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-postgres@0.6.2", "${env:POSTGRES_READONLY_URI}"],
      "env": {
        "OPENAI_API_KEY": "${env:OPENAI_API_KEY}"
      }
    }
  }
}

MCP02: Privilege Escalation via Scope Creep

Restrict filesystem MCP servers to explicit project subdirectories via allowedRoots: ["./workspace"] and enable readOnlyRootFilesystem: true. Avoid mounting /, ~, or passing --no-sandbox.

MCP03 & MCP05: Tool Poisoning & Command Injection

Audit tool metadata for imperative prompt overrides (ignore previous instructions, covert curl calls) and never invoke MCP servers through raw shell interpreters (bash -c, sh -c, powershell -Command).

3. High Severity Controls (MCP04, MCP06, MCP07, MCP10)

• MCP04 (Supply Chain): Remove -y / --yes from npx and pin exact semantic versions alongside a cryptographic mcp-lock.json file.
• MCP06 (Transport Security): Require https:// for remote SSE/HTTP endpoints or bind strictly to loopback 127.0.0.1.
• MCP07 (Human-in-the-Loop): Require explicit human approval gates (humanInTheLoop.requireApprovalFor) on write, delete, and execute operations to satisfy EU AI Act Article 14.
• MCP10 (Context Isolation): Replace static shared tokens with per-session ephemeral credentials (${session:ephemeral_token}).

4. Telemetry & Integrity Controls (MCP08, MCP09)

Configure structured JSONL audit logging (auditLogging.destination with 180-day retention) for EU AI Act Article 12 record-keeping, and record SHA-256 server digests under integrity.sha256.

5. JSONC Comments & Inline False-Positive Suppression

When auditing local development configs where telemetry or SHA-256 pinning is intentionally omitted, add an inline JSONC directive:

{
  "mcpServers": {
    // mcpshield-ignore MCP08, MCP09
    "local-sqlite-dev": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-sqlite@0.6.2", "./dev.db"]
    }
  }
}