OWASP MCP Top 10 to MITRE ATLAS crosswalk
This crosswalk maps each entry in the OWASP MCP Top 10 (2025) to the MITRE ATLAS technique it corresponds to. Seven of the ten map to a concrete ATLAS technique. The other three do not map to a single ATLAS technique, and we say so rather than inventing one.
Every row is grounded in a real detection rule: Pinaka's agent-surface engine already carries this OWASP-to-ATLAS mapping in code, so each row names the specific rule (an AS-* ID) that detects that risk in an MCP server's source. Sources: OWASP MCP Top 10 (2025, Beta) and MITRE ATLAS v2026.06 (released 2026-06-30).
The crosswalk
| OWASP MCP Top 10 | MITRE ATLAS technique | Detects it (Pinaka rule) |
|---|---|---|
| MCP01:2025 Token Mismanagement & Secret Exposure | AML.T0055 Unsecured Credentials; AML.T0083 Credentials from AI Agent Configuration | AS-SE-001, AS-IA-001 |
| MCP02:2025 Privilege Escalation via Scope Creep | AML.T0053 AI Agent Tool Invocation; AML.T0101 Data Destruction via AI Agent Tool Invocation | AS-EA-001 |
| MCP03:2025 Tool Poisoning | AML.T0110 AI Agent Tool Poisoning; AML.T0051.001 LLM Prompt Injection: Indirect; AML.T0068 LLM Prompt Obfuscation | AS-GI-001, AS-GI-002, AS-GI-003 |
| MCP04:2025 Software Supply Chain Attacks & Dependency Tampering | AML.T0050 Command and Scripting Interpreter; AML.T0053 AI Agent Tool Invocation | AS-TS-009 |
| MCP05:2025 Command Injection & Execution | AML.T0050 Command and Scripting Interpreter; AML.T0053 AI Agent Tool Invocation | AS-TS-001 through AS-TS-008 |
| MCP06:2025 Intent Flow Subversion | No clean 1:1 ATLAS technique (behavioral; adjacent to the prompt-injection family AML.T0051) | not code-detectable |
| MCP07:2025 Insufficient Authentication & Authorization | AML.T0083 Credentials from AI Agent Configuration | AS-IA-001 (AS-TR-001 is OWASP-only, no clean ATLAS technique) |
| MCP08:2025 Lack of Audit and Telemetry | No ATLAS technique (a missing control, not an offensive technique) | not code-detectable |
| MCP09:2025 Shadow MCP Servers | No clean 1:1 ATLAS technique (a discovery and governance gap) | not code-detectable |
| MCP10:2025 Context Injection & Over-Sharing | AML.T0086 Exfiltration via AI Agent Tool Invocation | AS-DL-001 |
The three that do not map, and why
A crosswalk is only trustworthy if it admits its gaps. Three OWASP MCP risks have no clean MITRE ATLAS technique, and forcing one would be worse than leaving it blank. MCP06 Intent Flow Subversion is a runtime behavioral property with no static-source signal. MCP08 Lack of Audit and Telemetry is a missing control, not an offensive technique. MCP09 Shadow MCP Servers is a discovery and governance gap, invisible from a single server's code.
How this crosswalk is built, and prior art
The mapping comes from the rule-to-standard table inside Pinaka's static analysis engine, which tags every finding with its OWASP MCP, OWASP LLM, and MITRE ATLAS references. A row here is the same mapping the scanner applies when it flags a real MCP server.
The adjacent prior art: SAFE-MCP, an OpenSSF (Linux Foundation) special interest group, adapts the MITRE ATT&CK methodology to MCP with its own SAF-T technique IDs. That is a different matrix. ATT&CK describes conventional adversary behavior; MITRE ATLAS is the matrix for attacks on AI systems, which is where MCP tool poisoning, prompt injection, and agent-driven exfiltration live. This crosswalk targets ATLAS on purpose.
Versions: OWASP MCP Top 10 is at 2025 (Phase 3, Beta). MITRE ATLAS technique IDs and names are from release v2026.06 (2026-06-30); older ATLAS v5.x is deprecated.
Questions
What is the OWASP MCP Top 10?
A community list, currently in 2025 beta, of the ten most important security risks specific to Model Context Protocol servers. It is the MCP-specific companion to the OWASP LLM Top 10.
What is MITRE ATLAS?
MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is the ATT&CK-style knowledge base of real-world attacker techniques against AI and machine-learning systems. Its AML.T technique IDs are the standard way to name an attack on an AI agent.
Does every OWASP MCP risk map to a MITRE ATLAS technique?
No. Seven of the ten map to a concrete ATLAS technique. Three (Intent Flow Subversion, Lack of Audit and Telemetry, Shadow MCP Servers) have no clean one-to-one ATLAS technique.
How is this different from SAFE-MCP?
SAFE-MCP maps MCP threats to MITRE ATT&CK. This crosswalk maps them to MITRE ATLAS, the matrix built for attacks on AI systems, and grounds each row in a named detection rule from a working scanner.
See also the MCP security guide and the agent attack surface scanner that applies these rules.