MCP Security OWASP MCP Top 10 — compiled & maintained by LK
Model Context Protocol · Agentic AI Attack Surface

31 SIEM use cases for
the OWASP MCP Top 10.

Every category in OWASP's first dedicated MCP security framework (beta, 2025), broken into concrete, monitorable SIEM use cases — each with the specific log source to onboard. OWASP defines the risk categories; the detection logic and log-source mapping here are authored for SOC/detection-engineering use, since OWASP itself doesn't publish SIEM content.

"
Don't boil the ocean.
MCP08 — Lack of Audit and Telemetry — has to be fixed first: without tool-invocation logging, none of the other 30 use cases here have anything to run against.

OWASP MCP Top 10 (2025)

the ten official risk categories — click to filter use cases below

Browse detection use cases

filter by severity, search by name or log source

loading use cases…

Related in your other libraries

where MCP already shows up across the rest of the detection catalog

MITRE ATLAS — 6 techniques directly reference agent tools/MCP: AML.T0110 AI Agent Tool Poisoning and its Runtime Response sub-technique, AML.T0111 AI Supply Chain Reputation Inflation, plus AI Agent Configuration and AI Agent Tool(s) data components — and 3 real case studies: Data Exfiltration via an MCP Server used by Cursor (AML.CS0045), Poisoned Postmark MCP Server Email Exfiltration (AML.CS0053), and Data Exfiltration via Remote Poisoned MCP Tool (AML.CS0054). See the AI Security Use Case library.

Sigma rule catalog — 2 mirrored rules already cover MCP-adjacent supply-chain indicators: LiteLLM / TeamPCP Supply Chain Attack Indicators and its persistence variant, relevant to MCP04 (Supply Chain) above. See the Detection Use Cases catalog.