Complete OWASP MCP Top 10 Coverage
The MCP scanner now covers all ten risk categories in the OWASP MCP Top 10 — every threat on that list that can be caught by reading the code alone, without ever running it. The new detections are grounded in OWASP’s companion MCP CVE index, a catalog of more than 570 real-world security flaws reported across the MCP ecosystem. That brings the scanner to 22 MCP security checks, up from 15 at launch.
Attacks hidden in everyday operations. Three new checks catch MCP server code that lets outside input change what a database is asked to do (so an attacker could read or corrupt data), code that loads saved data in a way that can be tricked into running an attacker’s own code, and code that copies outside input straight into log files — which lets an attacker cover their tracks by forging or hiding log entries.
MCP servers left open to the world. Two new checks flag MCP servers that any website can talk to through a visitor’s browser instead of only trusted sites, and MCP servers reachable from the whole network rather than just the intended machine, with no check on who’s connecting. Openings like these are behind the largest share of reported MCP security flaws.
Secrets and unapproved startup commands. The scanner now catches passwords, API keys, and other secrets written directly into the code, where anyone with access to the repository can read them — and setup files that automatically run an unvetted command the moment they load, before anyone has approved it.
Sharper Existing Checks
Lookalike tool names. Beyond exact duplicates, the scanner now catches tool names that merely look nearly identical — different capitalization, punctuation, or a one-letter change — which is enough to trick an agent into picking the wrong tool.
Complete coverage of invisible characters. Attackers can hide instructions in text using characters that are invisible on screen or that imitate ordinary letters. Every check that looks for these tricks now draws on one complete catalog of them, so the same disguise is caught wherever it appears.
Better judgment on protected commands. When an MCP server runs a command, what matters is whether the input is checked first. The scanner now recognizes many more of the ways developers legitimately do that checking, giving it a more accurate read on which commands are truly protected.
A wider net for open-ended tools. Tools built to accept any input at all give an attacker room to work with. The scanner now spots more of the ways a tool can be defined that way.