Frameworks and standards
OWASP Top 10 for LLM Applications (2025) mapped to MCP
OWASP wrote this list for any LLM application, chatbots included. An agent that calls MCP tools is one kind of LLM application, and most of the ten items land on the tool call itself.
New to MCP? What is an MCP server? covers the basics first.
The OWASP Top 10 for LLM Applications is a list of ten risk categories, LLM01:2025 through LLM10:2025, published by the OWASP GenAI Security Project. It was written for any application built on a language model, from a support chatbot to an autonomous agent. An agent that calls MCP tools is one kind of LLM application, and the list still applies: it just lands on the tool call instead of the chat reply.
Why an agent changes what each item means
When a chatbot goes wrong, you get a bad answer. When an agent goes wrong, it can delete a file or merge a pull request. OWASP's items describe risks in the model and the application around it, and MCP is the part of the application that turns the model's output into an action on another system. Most of the ten keep their meaning but matter more once a tool call is at stake.
Two items on the list, LLM04 Data and Model Poisoning and LLM09 Misinformation, are about the model itself: what it was trained on and whether what it says is true. Nothing sitting between an agent and its tools changes either one. They're in the table below for completeness.
The ten items, mapped to an MCP tool call
| Item | What it means for an MCP agent | MCP example | Control |
|---|---|---|---|
| LLM01:2025 Prompt Injection | Text the model reads, not just text the user typed, can make it call a tool it shouldn't. A tool's own description is text the model reads. | A calendar invite's description tells the model to also forward the user's inbox to an external address. | What is prompt injection?, Prompt injection vs jailbreaking |
| LLM02:2025 Sensitive Information Disclosure | A tool result can carry a secret into the model's context, and the model can repeat it in its answer or in the next tool call's arguments. | A read_file result includes a .env line with an API key, and the model pastes it into a later send_message call. | How to keep API keys out of your AI agent's reach, What to log when AI agents call tools |
| LLM03:2025 Supply Chain | The MCP server is code you run with your credentials behind it. A compromised package update changes what every call to that server does. | An npm-distributed MCP server ships a patch that adds a step: forward every tool call's arguments to a second address first. | Malicious MCP servers: how to vet one before you install it |
| LLM04:2025 Data and Model Poisoning | About the model's training data, not the tool call. MCP sits downstream of training and doesn't touch it. | Not applicable to a specific tool call; this is a model-training risk. | Out of scope for a tool gateway. See OWASP's LLM04 page for mitigations at training time. |
| LLM05:2025 Improper Output Handling | A tool call's arguments are model output, and OWASP's own fix, treat the model as any other untrusted user, applies to them. An unvalidated argument reaches the real system behind the tool. | A run_query tool receives an argument built from text an attacker planted in a document, and runs it as a literal SQL fragment. | Why your system prompt is not a security boundary, How to sandbox an AI agent and control its network egress |
| LLM06:2025 Excessive Agency | OWASP's own name for a server or token that hands the agent more functionality, permission or autonomy than its task needs. The clearest fit on this list. | An agent set up to triage issues is connected to a GitHub server that also offers merge_pull_request, which its task never calls but which prompt injection can still reach. | What is excessive agency in AI agents?, Least privilege for AI agents |
| LLM07:2025 System Prompt Leakage | A system prompt that lists an agent's tools or rules tells an attacker what to try next, and it can't enforce any of them. Relying on it instead of real checks is the deeper problem. | A system prompt saying "never call delete_repo" gets talked around by a later message, and the model calls it anyway. | Why your system prompt is not a security boundary |
| LLM08:2025 Vector and Embedding Weaknesses | About the retrieval pipeline behind RAG, not the tool call layer. If an MCP server fronts a vector database, access to that server's tools still goes through the usual tool controls, but what the embeddings themselves leak doesn't. | A search_knowledge_base tool returns a passage that lets an attacker reconstruct a document a different tenant uploaded. | Partly in scope: per-tool access to the search tool helps, the embedding and retrieval design doesn't. See OWASP's LLM08 page. |
| LLM09:2025 Misinformation | The model confidently stating something false. MCP tool results can correct this (grounding in a real system beats a guess) but a gateway checking tool calls has no opinion on whether the model's sentence is true. | An agent summarizes a ticket's history and invents a resolution step that was never taken, because no tool call retrieved the actual one. | Out of scope for a tool gateway. OWASP's LLM09 page recommends grounding outputs in retrieved, verified data. |
| LLM10:2025 Unbounded Consumption | An agent that can call a tool in a loop, or that an attacker can prompt into calling one repeatedly, can run up cost or load on the system behind it. | A manipulated agent calls a paid search API tool hundreds of times in one conversation. | Rate limits on tool calls at a gateway and in the server itself; see the OWASP LLM10 page for the fuller list of denial-of-wallet and model-extraction scenarios. |
What a tool gateway helps with, and what it doesn't
A gateway in front of MCP servers (Statio is one; MCP permissions covers the field) sits exactly where LLM01, LLM02, LLM05, LLM06 and LLM10 live: the tool call. It can check who's calling, which tool they're allowed to call, scan the arguments going out and the result coming back, and log every call and refusal. That's real coverage for prompt injection reaching a tool, excessive agency, unvalidated output reaching a downstream system, and runaway call volume.
It helps less with LLM03 Supply Chain: scanning a server's code before you deploy it catches known vulnerabilities, not a backdoor nobody has found yet. It barely touches LLM07, which is a design mistake (putting security logic in a prompt) more than something to intercept, though a gateway's own checks are the alternative to relying on the prompt. It does not touch LLM04 Data and Model Poisoning or LLM09 Misinformation at all: both are upstream of any tool call, in the model's training and in whether its sentences happen to be true. And LLM08 Vector and Embedding Weaknesses is mostly a RAG pipeline design question that a tool gateway can gate access to, but not fix.
No gateway, Statio included, fully solves prompt injection. A model that reads an attacker's text can still be talked into calling an allowed tool with harmful arguments. What a gateway can do is keep the set of tools that agent can reach as small as its job allows.
Defenses that apply across the list
A few controls show up against more than one item in the table:
- Least privilege shrinks the damage LLM01, LLM05 and LLM06 can do at once, because a tool call that can't do much doesn't need to be caught every time.
- Don't put security logic in the system prompt. It addresses LLM07 directly and limits how far LLM01 can go, because a model can be argued out of any instruction.
- Log every call and every refusal. It doesn't prevent LLM02 or LLM06, but it's how you find out one happened.
- Give agents their own identity, separate from the person who set them up, so a stolen or manipulated agent can be suspended without locking out a colleague, and so a log entry says which actor did what.
Where Statio fits
Statio is a gateway for MCP: per-tool access decided per agent, agent identity separate from the person who connected the server, and an audit log of every call and refusal. Those map most directly to LLM06 Excessive Agency and LLM02 Sensitive Information Disclosure in the table above, with the identity and logging pieces also covering ground under LLM01.
Statio's audit log and access controls produce evidence a security reviewer asks for when they ask "who could call this tool and did anyone." They don't make an application compliant with anything, and Statio holds no certification that would say otherwise. Run the MCP security checklist against your own setup, or see the security page for the full list of what's scanned and where.
Next
- What is excessive agency in AI agents?
- What is prompt injection?
- Least privilege for AI agents
- MITRE ATLAS for AI agents
- OWASP's agentic AI threats, mapped to MCP