AI Agent Security Standards Mapping
The OWASP, MITRE ATLAS and MCP specification IDs that findings from an AI agent and MCP security assessment map to, read standard by standard, with the risk class and checklist items behind each ID.
https://veriprajna.com/ai-services/ai-agent-mcp-security-assessment/standards-mapping
The IDs our findings map to, by standard
Pick a standard to see each ID our findings map to, the risk class it belongs to and the checklist items that describe the control. The filter searches all five standards at once.
OWASP Top 10 for LLM Applications 2026
| ID | Name | Risk class | Checklist items |
|---|---|---|---|
LLM01:2026 | Prompt Injection | Indirect prompt injection | Agent IN-1 to IN-5; Agent ME-1 to ME-5; MCP TO-2, TO-3 |
LLM03:2026 | Excessive Agency | Excessive agency and tool misuse | Agent TP-1 to TP-8; Agent AP-1 to AP-5 |
LLM04:2026 | Supply Chain | Supply chain | MCP LS-1 to LS-5 |
No match in OWASP Top 10 for LLM Applications 2026.
OWASP Top 10 for Agentic Applications for 2026
| ID | Name | Risk class | Checklist items |
|---|---|---|---|
ASI01 | Agent Goal Hijack | Indirect prompt injection | Agent IN-1 to IN-5; Agent ME-1 to ME-5; MCP TO-2, TO-3 |
ASI02 | Tool Misuse and Exploitation | Tool poisoning; Excessive agency and tool misuse | Tool poisoning: MCP TD-1, TD-2; Excessive agency: Agent TP-1 to TP-8, AP-1 to AP-5 |
ASI03 | Identity and Privilege Abuse | OAuth, tokens, confused deputy | MCP AU-1 to AU-7; Agent ID-1 to ID-5 |
ASI04 | Agentic Supply Chain Vulnerabilities | Tool poisoning (if the server is malicious at source); Rug pull; Supply chain | Tool poisoning at source: MCP TD-1, TD-2; Rug pull: MCP TD-3, LS-4; Supply chain: MCP LS-1 to LS-5 |
ASI06 | Memory & Context Poisoning | Indirect prompt injection | Agent ME-1 to ME-5; Agent IN-1 to IN-5; MCP TO-2, TO-3 |
No match in OWASP Top 10 for Agentic Applications for 2026.
OWASP MCP Top 10 (beta)
| ID | Name | Risk class | Checklist items |
|---|---|---|---|
MCP01:2025 | Token Mismanagement & Secret Exposure | OAuth, tokens, confused deputy | MCP AU-1 to AU-7; Agent ID-1 to ID-5 |
MCP02:2025 | Privilege Escalation via Scope Creep | OAuth, tokens, confused deputy | MCP AU-1 to AU-7; Agent ID-1 to ID-5 |
MCP03:2025 | Tool Poisoning | Tool poisoning | MCP TD-1, TD-2 |
MCP04:2025 | Software Supply Chain Attacks & Dependency Tampering | Supply chain (a trusted server, dependency or developer tool is compromised or has an exploitable flaw) | MCP LS-1 to LS-5 (examples: CVE-2025-6514, CVE-2025-49596) |
MCP05:2025 | Command Injection & Execution | SSRF and malicious authorization URLs | MCP AU-8, AU-9 (example: CVE-2025-6514) |
MCP06:2025 | Prompt Injection via Contextual Payloads | Indirect prompt injection | Agent IN-1 to IN-5; Agent ME-1 to ME-5; MCP TO-2, TO-3 |
MCP07:2025 | Insufficient Authentication & Authorization | OAuth, tokens, confused deputy | MCP AU-1 to AU-7; Agent ID-1 to ID-5 (example: GHSA-rvq5-wwqv-78pq) |
MCP08:2025 | Lack of Audit and Telemetry | Logging and detection | MCP LG-1 to LG-3; Agent LG-1 to LG-4 |
No match in OWASP MCP Top 10 (beta).
MITRE ATLAS
| ID | Name | Risk class | Checklist items |
|---|---|---|---|
AML.T0110.000 | AI Agent Tool Poisoning: Definition and Instructions | Tool poisoning | MCP TD-1, TD-2 |
AML.T0110.001 | AI Agent Tool Poisoning: Implementation | Rug pull | MCP TD-3, LS-4 |
AML.T0109 | AI Supply Chain Rug Pull | Rug pull | MCP TD-3, LS-4 |
AML.T0051.001 | LLM Prompt Injection: Indirect | Indirect prompt injection | Agent IN-1 to IN-5; Agent ME-1 to ME-5; MCP TO-2, TO-3 |
AML.T0099 | AI Agent Tool Data Poisoning | Indirect prompt injection | MCP TO-2, TO-3; Agent IN-1 to IN-5; Agent ME-1 to ME-5 |
AML.T0086 | Exfiltration via AI Agent Tool Invocation | Data out through permitted tools | Agent DO-1 to DO-4 |
No match in MITRE ATLAS.
Model Context Protocol specification
| ID | Name | Risk class | Checklist items |
|---|---|---|---|
Tool Safety | Key Principles, Security and Trust & Safety | Tool poisoning | MCP TD-1, TD-2 |
Security Best Practices | Attacks and Mitigations | OAuth, tokens, confused deputy; SSRF and malicious authorization URLs | OAuth: MCP AU-1 to AU-7, Agent ID-1 to ID-5; SSRF: MCP AU-8, AU-9 |
State Handle Hijacking | Security Best Practices, Attacks and Mitigations | Transport, state handles and legacy sessions | MCP TR-1 to TR-5 |
Session Hijacking | Security Best Practices, 2025-11-25 version | Transport, state handles and legacy sessions (protocol 2025-11-25 and earlier) | MCP TR-1 to TR-5 |
No match in Model Context Protocol specification.
- Each standard lists only the IDs our findings map to, not the whole list.
- Cross-server tool shadowing, where one server's tool description changes how the agent uses another server's tool, was described by Invariant Labs in April 2025; checklist item MCP TD-4 covers it.
- The data-out risk class takes its shape from Simon Willison's lethal trifecta: private data, untrusted content and a way to send data out, all in one agent.
- Checklist keys starting MCP refer to the MCP Server Security Checklist, and keys starting Agent refer to the AI Agent Security Checklist.
Get your AI agents and MCP servers tested
This mapping shows which IDs a finding is filed under. An assessment, starting with a short discovery call, shows whether your own agent and MCP servers are exposed.
- Email or WhatsApp us
- Reply within 1 business day
- Free 30-minute discovery call
- Written scope and fixed fee within 2 business days of the call