OWASP LLM & MCP Top 10 crosswalk
Two OWASP lists describe the risks of running AI in production: the Top 10 for LLM Applications, about the model call, and the MCP Top 10, about the tool call underneath it. This page maps both to controls that can sit on the request path, and says plainly where they cannot.
OWASP Top 10 for LLM Applications (2025) · OWASP MCP Top 10 (2025)
Checked 29 August 2026. The MCP list is a beta release (v0.1) with a full release due October 2026 — entry ids and titles may still change, and this page is re-checked when it lands. Read the primary sources rather than this summary.
What this is not
Neither list is a standard you can comply with. Both are catalogues of risk, so there is nothing to be certified against and no score to achieve. Anything that offers you an "OWASP compliance rating" is selling you something that does not exist.
A request path cannot address every entry. Four of the twenty are about how a model or a dependency was built, which happens long before a request arrives. Saying so is the point of the page — a crosswalk that claims full coverage is not a crosswalk, it is a brochure.
Where controls can act: the LLM Top 10
| Entry | In plain terms | What a governed request path can do |
|---|---|---|
| LLM01 Prompt Injection | Someone hides instructions in the input to make the model do something else | Injection detection on the request before it reaches the model — patterns, semantic similarity, and an optional classifier |
| LLM02 Sensitive Information Disclosure | Personal or confidential data reaches the model, or comes back in a reply | Detection on both request and response, with block, redact or log; redaction runs before anything is written to cache |
| LLM03 Supply Chain | A compromised model, dependency or plugin | Nothing. This is a build and procurement control, not a request-time one |
| LLM04 Data and Model Poisoning | Training or tuning data is tampered with | Nothing. It has already happened before the first request |
| LLM05 Improper Output Handling | A reply is passed to another system without being checked | Output schema validation, and sanitisation of the reply before it is returned |
| LLM06 Excessive Agency | The system can do more than it should be able to | Human approval gates on consequential actions, per-agent permissions, loop detection, session kill switch |
| LLM07 System Prompt Leakage | The system prompt comes back out in a reply | Partial. Response scanning catches disclosure that looks like sensitive data; nothing recognises a leaked system prompt as such |
| LLM08 Vector and Embedding Weaknesses | Retrieved or cached data leaks between users | Partial. The semantic cache is scoped per workspace and PII is stripped before write. Retrieval systems outside the path are not covered |
| LLM09 Misinformation | The reply asserts things nothing supports | Grounding detection against source documents — only when the caller supplies sources |
| LLM10 Unbounded Consumption | Spend or load runs away | Budget caps that refuse rather than alert, per-call cost limits, rate limits, and automatic stops on runaway loops |
Where controls can act: the MCP Top 10
| Entry | In plain terms | What a governed request path can do |
|---|---|---|
| MCP01 Token Mismanagement & Secret Exposure | Credentials sit somewhere they should not | Credentials held per workspace — encrypted, or as a reference to your vault — and rotated with a grace window rather than a cutover |
| MCP02 Privilege Escalation via Scope Creep | An agent acquires capability it was never meant to have | Per-workspace allow-lists of servers and tools, and policy deciding which may be called at all |
| MCP03 Tool Poisoning | A tool's description or output manipulates the agent | Partial. Injection detection on tool arguments and responses |
| MCP04 Software Supply Chain Attacks | A compromised dependency changes agent behaviour | Nothing. Same reason as LLM03 |
| MCP05 Command Injection | Untrusted input becomes a command that runs | Partial. Argument scanning and tool policy. The system that executes the command is not ours |
| MCP06 Intent Flow Subversion | Injected context redirects the agent from its goal | Partial. Injection detection, plus loop detection across the session |
| MCP07 Insufficient Authentication & Authorization | Nobody checks who is calling | Every call carries a workspace identity, each hop is authorised, and on-behalf-of tokens carry the delegation |
| MCP08 Lack of Audit and Telemetry | You cannot reconstruct what happened | A signed, hash-chained record of every call, per-call telemetry, and export to your SIEM |
| MCP09 Shadow MCP Servers | Servers running outside anyone's governance | The registry is the allow-list — but only for traffic that goes through it. See the limit below |
| MCP10 Context Injection & Over-Sharing | Context leaks between tasks, users or agents | Partial. Scanning on arguments and responses, and workspace isolation of stored context |
The limit worth stating twice
A control point sees what goes through it. That is the whole mechanism, and it is also the boundary: a team that calls a provider directly, or wires up a tool server nobody registered, is invisible to it. MCP09 Shadow MCP Servers is therefore only half-answerable by any gateway — it can guarantee that governed traffic reaches approved servers, and it cannot tell you about traffic that never arrived.
Closing the other half is a network and procurement question: egress policy, credential issuance, and knowing which teams hold provider accounts. No product setting substitutes for it.
The four entries nothing on the request path reaches
LLM03, LLM04, MCP04 and — for the executing system — MCP05. These are about what was built and what was installed, not about what a request does. They belong to code review, dependency scanning, model provenance and procurement.
They are listed here because a crosswalk that quietly omits its own gaps is worse than none: the gaps are where you need a different control, and that is the useful thing to know.
Which of these you should look at first
The AI readiness scorecard asks fifteen plain questions and reports which of these entries your answers relate to. It takes about five minutes, needs no email to see the result, and nothing you answer leaves your browser.
It is a self-assessment, not a test: it records what you believe about your own controls and does not examine them.