2026-10-04 OWASP MCP Security Taxonomy - a common language for MCP risks, still at v0.1

Canonical version: 2026-10-04 OWASP MCP Security Taxonomy - a common language for MCP risks, still at v0.1.

OWASP has a new project for anyone who connects AI agents to tools and data: the MCP Security Taxonomy. Tagline: "A common language for securing agentic AI connections, context, and capability." The repository was created in May 2026, the real content landed on August 27, and the last update is from September 6. Vandana Verma Sehgal maintains and curates it, and it's labelled v0.1.

Same bug, three names

The Model Context Protocol (MCP) is the standard way to plug tools into AI agents. Each MCP server you add can read files, run shell commands, hold API tokens or talk to your SaaS accounts, and adding one usually takes a single line of JSON config.

Security write-ups don't agree on what to call things. One audit says "tool poisoning", another says "prompt injection", a third says "supply chain". Same bug, three names, and you can't compare findings across teams or vendors.

A taxonomy fixes the naming. Give every risk, weakness and control a stable name, map those names to the frameworks security and compliance teams already use (OWASP, CWE, MITRE ATLAS and ATT&CK, NIST CSF, ISO 27001, the EU AI Act, SOC 2), and a finding in one report means the same thing in the next.

What's in v0.1

Everything sits in one combined document of a bit over 2,200 lines:

• A relationship map of host, client, server, transport and backends. Handy, because people mix up the host (the AI app) and the client (the connector inside it) all the time
• A glossary of well over a hundred MCP, AI security and AppSec terms, each with why it matters for security and an example. Rug pull, shadow MCP, toxic flow, tool description drift...
• An eleven-domain model (MCP-ST-01 to MCP-ST-11), from Architecture & Trust Boundaries to Testing, Assurance & Compliance, with a strict schema for entries
• A mapping to the OWASP MCP Top 10 (MCP01 Token Mismanagement to MCP10 Context Injection & Over-Sharing), with examples, impacts and controls
• Root-cause tags built from real MCP CVEs: INJ-CMD, PATH-TRAV, SSRF, AUTH-BYPASS, X-TENANT and about twenty more
• Crosswalks to academic taxonomies (MCP-38, MCPShield, MCP-DPT, MCPSecBench) and the IETF draft on MCP security

The entry schema sets a high bar. Prompt-integrity entries need both a direct and an indirect injection scenario. Tool and data entries need a "toxic flow" example, where tool calls that are each allowed chain into data exfiltration. Governance entries must explain how authorization works on every tools/call.

The CVEs are mostly classic AppSec bugs

Read the root-cause tags: command injection, path traversal, SSRF, broken OAuth flows, missing auth on a network listener, overly permissive CORS...

The CVEs collected so far are mostly old-school bugs in code that runs with too many permissions. So securing an MCP server starts where securing any web service starts: validate inputs, don't build shell commands from strings, apply the Least Privilege Principle, and log what happens.

Where v0.1 falls short

• The catalog is empty. The eleven domains and the entry schema are defined, but no MCP-ST entries are published yet. For now you get a glossary, a mapping and a schema
• Two domain models coexist; the older seven-domain overview still drives the navigation
• It's mostly one person's work (plus a companion CVE index from the same maintainer). A common language only sticks when many people use it and shape it
• The license is GPL-3.0, which is unusual for a reference document. Check what that means before you copy big chunks into your own docs or tools

How I'd use it today

1. Before installing any MCP server, go through the "beginner translation" table. For each part (host, client, server, tool, resource, prompt, gateway, registry), it gives you the one security question to ask
2. If you build MCP servers, use the OWASP MCP Top 10 mapping as a review checklist. I build some myself (the Obsidian CLI REST MCP plugin for Obsidian exposes an MCP endpoint), and MCP05 (command injection) and MCP07 (missing auth on localhost) are the two I'd check first
3. If you report MCP vulnerabilities, tag them with the root-cause families, so the numbers become comparable
4. If you have opinions, send them now. It's v0.1 and the structure can still change

I've written a permanent note with the full details (the eleven domains, the Top 10 table, all the root-cause tags): OWASP MCP Security Taxonomy.

That's it for today! ✨

References

• OWASP MCP Security Taxonomy (GitHub): https://github.com/OWASP/MCP-Taxonomy
• Vandana Verma Sehgal on GitHub: https://github.com/vermava
• Companion CVE index (mcp-cve-project): https://github.com/vermava/mcp-cve-project
• OWASP MCP Top 10: https://owasp.org/www-project-mcp-top-10/
• OWASP, A Practical Guide for Securely Using Third-Party MCP Servers: https://genai.owasp.org/resource/a-practical-guide-for-securely-using-third-party-mcp-servers/

Related

• OWASP MCP Security Taxonomy
• Model Context Protocol (MCP)
• MCP Gateway Registry
• Model Context Protocol Registry
• Prompt injection
• Lethal Trifecta for AI Agents
• Least Privilege Principle
• Software Supply Chain Security
• Static Application Security Testing (SAST)
• Zero Trust Security

About Sébastien

Ready to get to the next level?