42Crunch protects every MCP server within a repeatable, scalable framework: discovered, audited, scored, scanned, and gated before it earns a place in production. Here's how that workflow maps to each of the ten OWASP MCP Top 10 risk categories.
MCP did for AI agents what OpenAPI did for web APIs a decade ago: it gave a fragmented ecosystem a common contract. An agent no longer needs custom glue code for every tool it calls — it just points at an MCP server, reads the tool descriptions, and starts invoking them. That convenience is exactly the problem: there's no schema validation gate, no default authentication requirement, and no built-in way to tell a legitimate tool description from one an attacker rewrote to smuggle in a new instruction. The OWASP MCP Top 10 is the community's first attempt to catalog exactly how that trust gets abused.
Every category 42Crunch's MCP security workflow — Contract, Audit, Security Quality Gate, Scan, and Findings — is built to detect and enforce against.
Hard-coded credentials or long-lived tokens sit in model memory, protocol logs, or debug traces and get pulled out via prompt injection.
Every discovered server becomes a version-controlled contract, so credentials or long-lived tokens surfaced in tool descriptions or debug output show up as a dated, attributable finding — not something buried in a chat transcript.
Loosely scoped or temporary permissions expand over time, letting an agent do far more than it was ever meant to.
The Audit engine scores the MCP contract's declared scopes against structural best practice, and the Security Quality Gate blocks any server whose permissions can't be justified from reaching production.
An adversary compromises a tool, its description, or its output — rug pulls, schema poisoning, and tool shadowing all fall here.
A dedicated PromptDefense analyzer scans every tool description for missing instruction-override defenses, and the absence of message signing — a structural precondition for rug pulls and tool shadowing — is flagged at the server level.
A compromised open-source connector or plug-in alters agent behavior or opens an execution-level backdoor.
Every dependency an MCP server pulls in — every connector, every plug-in — is part of the audited surface. A dependency that changes a tool's behavior or introduces new execution paths shows up as a version-over-version change in the Audit and Scan results.
An agent builds and runs shell commands, API calls, or code from untrusted input without validation.
Scan flags any tool whose description implies it will construct or execute commands from user-supplied input as a missing-defense finding, with the exact remediation to close the gap.
Malicious instructions embedded in retrieved context hijack the agent's goal — a secondary instruction channel the user never sees.
A finding like "no instruction override defense found" is a direct, testable proxy for intent flow subversion: if a tool description doesn't explicitly instruct the model to reject attempts to override its guidance, Scan flags it before the server ships.
Servers, tools, or agents fail to properly verify identity or enforce access control across a multi-agent exchange.
The Audit engine scores the contract against mandatory authentication patterns, and the Security Quality Gate enforces that threshold as a release criterion rather than optional guidance.
Missing logs of tool invocations and context changes make investigation and incident response nearly impossible.
Every finding is a persistent, filterable, timestamped record, so a regression between last week's release and this one is a specific, attributable diff — not a surprise discovered during an incident.
Unapproved, unsupervised MCP instances spun up outside governance, often on default credentials.
Continuous discovery finds MCP servers across the enterprise automatically and generates a contract for each one found — turning shadow servers from a blind spot into a tracked inventory the moment they appear.
Shared or insufficiently scoped context windows leak one user's or agent's data into another's session.
Every tool's declared inputs and outputs are captured in the contract and re-verified on every audit, so a tool that quietly starts requesting broader context access than its prior version shows up as a diff, not a surprise.
By validating tool definitions, inputs, credentials, permissions, isolation, and delegated identity against the approved MCP Contract, 42Crunch blocks unsafe MCP servers before connection and detects drift after deployment — including excessive permissions (over-privileged tools violating least-privilege, where one breach compromises everything), insufficient isolation (cross-tenant data leakage, shared service accounts, unsandboxed execution), and confused deputy attacks, where token passthrough tricks a server into misusing a user's own privileges.
A community-led catalog, currently in beta under project lead Vandana Verma Sehgal, of the ten most critical risk categories specific to the Model Context Protocol — from token mismanagement and tool poisoning to shadow servers and context over-sharing. It's the MCP-era counterpart to the long-established OWASP API Security Top 10.
It's in beta and actively maintained by the OWASP community. 42Crunch tracks the project directly and updates its Audit, Scan, and Security Quality Gate checks as the categories are refined, so coverage doesn't lag behind the standard.
Both. Several categories — command injection, insufficient authentication, shadow servers, supply chain tampering — are risks to the server itself, exploitable without ever manipulating the model. 42Crunch's Audit and Scan engines evaluate the server as a standalone attack surface, not only as a vector for agent manipulation.
Every server gets a deterministic score and grade from the Audit and Scan engines, broken down by category. The same server evaluated twice returns the same score and the same findings — reproducible, not an estimate — and each finding carries a specific, testable remediation.
Yes. The Security Quality Gate enforces a minimum acceptable score in CI/CD and refuses to let a server below that threshold reach production — no manual override.
Same discipline, new artifact. 42Crunch has applied contract-first security to REST and GraphQL APIs for years; the OWASP MCP Top 10 workflow is that same model — discover, audit, gate, scan, evidence — pointed at MCP servers and their natural-language tool descriptions instead of OpenAPI paths and parameters.
Point 42Crunch at any MCP server and get a report scored against all ten OWASP MCP Top 10 categories in under 60 seconds. No agent, no deployment, no commitment required.