OWASP Top 10 for LLM Applications and MCP
The OWASP Top 10 for LLM Applications 2026 is cfgaudit's primary mapping: every rule belongs to one of its categories. cfgaudit's 116 rules cover 4 of the ten in the files that configure an agent. The remaining 6 are about training data, providers, model output and application code, which a configuration file doesn't contain.
-
Text the agent reads as trusted context tells it to do something else: override phrases, hidden Unicode, fake turn boundaries and concealment orders in CLAUDE.md, AGENTS.md, rules files, skills and commands.
- CFG009 hook command interpolates a shell variable
- CFG015 hook command contains shell substitution
- CFG024 instruction file contains hidden Unicode control characters
- CFG026 instruction file contains instruction-bypass phrases
- CFG030 instruction file instructs the agent to conceal its behavior
- CFG032 instruction file contains system-prompt control tokens or pseudo-system tags
- CFG034 instruction file contains Guidance/Jinja template syntax
- CFG056 skill/command/subagent has a broad/always-on invocation trigger
- CFG057 encoded/hidden payload in an instruction file
- CFG080 instruction file hides a directive inside an HTML comment
- CFG081 instruction file tells the agent to survive context compaction
- CFG092 committed Kimi agent file replaces the whole system prompt (override: true)
- CFG113 an instruction file tells the agent to fetch remote text and follow it
- CFG116 an instruction file imports a file from outside the repository
-
Secrets and private files reach the model or leave the machine: credentials committed in settings and MCP configs, missing deny rules for .env and keys, commands that read credential files or send data to a remote host.
- CFG005 ANTHROPIC_BASE_URL points to a non-Anthropic endpoint
- CFG007 hardcoded secret in env block
- CFG012 settings.json structure does not match the official schema
- CFG013 local Claude files exist but are not excluded in .gitignore
- CFG016 credential helper defined in project-scoped settings
- CFG021 MCP server env routes traffic through a non-local proxy
- CFG031 instruction file references sensitive file paths
- CFG033 instruction file contains a markdown image exfiltration pattern
- CFG036 instruction file embeds shell commands for auto-execution or exfiltration
- CFG037 command reads or copies SSH private keys
- CFG038 command dumps environment variables to the network
- CFG041 permissions.deny does not restrict access to .env files
- CFG042 permissions.deny does not restrict private key / certificate files
- CFG043 permissions.deny does not restrict cloud provider credential files
- CFG044 permissions.deny does not restrict SSH private keys
- CFG046 OTEL exporter endpoint redirects telemetry off-host
- CFG049 remote MCP server URL points to a non-loopback host
- CFG050 hardcoded secret in an MCP server env or headers
- CFG054 high-entropy value that looks like a hardcoded secret
- CFG058 MCP server uses the deprecated sse transport
- CFG065 Continue config has a hardcoded inline apiKey
- CFG068 templated credential forwarded to a cleartext / raw-IP MCP endpoint
- CFG069 HTTP-transport MCP server without log redaction
- CFG071 model/provider base URL sends the API key over cleartext
- CFG072 DNS-channel exfiltration in a command
- CFG073 hardcoded cryptocurrency signing credential
- CFG075 MCP server disables TLS certificate verification (MITM kill switch)
- CFG078 command reads an OS credential store
- CFG082 Docker daemon redirected off-host (DOCKER_HOST / docker -H)
- CFG088 http hook posts agent events to a remote endpoint
- CFG097 committed Gemini remote agent uses cleartext or carries a credential
- CFG099 qwen settings pick the agent's infrastructure
- CFG112 an MCP server sends a local file as its bearer token
- CFG115 a committed config path is a symbolic link leaving the repository
-
The agent can do more than the task needs without asking: unrestricted shell and write permissions, bypass and YOLO modes, auto-approved MCP servers, hooks that run on every session, instructions not to ask for confirmation.
- CFG001 permissions.allow contains unrestricted Bash pattern
- CFG002 permissions.allow contains unrestricted file-write pattern
- CFG003 enableAllProjectMcpServers: true
- CFG004 defaultMode set to bypassPermissions or auto
- CFG006 permissions.deny is absent or empty
- CFG008 hook command contains reverse-shell pattern
- CFG011 MCP server alwaysAllow is too broad
- CFG017 MCP server sets dangerouslyAllowBrowser: true
- CFG018 MCP server binds to all network interfaces (NeighborJack)
- CFG019 MCP server command is an inline-script interpreter
- CFG020 MCP server env injects code at process startup
- CFG022 sandbox config weakens or hijacks the execution sandbox
- CFG023 permissions.allow grants a dangerous command with open-ended args
- CFG025 custom organisation policy (require-deny / forbid-allow)
- CFG027 command installs a persistence mechanism
- CFG028 command writes to a Claude trust/config file
- CFG029 instruction file instructs the agent to bypass permission prompts
- CFG035 instruction file instructs the agent to configure or trust an MCP server
- CFG039 command contains recursive force-delete (rm -rf)
- CFG040 permissions.allow contains unrestricted WebFetch
- CFG045 ShellCheck analysis of hook / helper commands
- CFG047 a committed task file auto-runs a command
- CFG048 .vscode/settings.json blanket-auto-approves agent tools
- CFG051 skill/command/subagent grants overly broad allowed-tools
- CFG053 blanket MCP-trust settings beyond enableAllProjectMcpServers
- CFG060 Gemini CLI auto-approves tool actions (defaultApprovalMode)
- CFG061 Gemini CLI sandbox weakened (tools.sandbox*)
- CFG063 Codex CLI removes the human from the approval loop
- CFG064 Codex CLI sandbox disabled or widened
- CFG066 MCP server env sets a wildcard CORS origin
- CFG076 MCP server exposes a broad filesystem root
- CFG077 command destroys an audit trail (anti-forensics)
- CFG079 autoMode weakens the auto-mode permission classifier
- CFG083 MCP server args carry a Chromium command-replacing launch switch
- CFG085 subagent frontmatter weakens the permission mode
- CFG087 committed agent hook auto-approves tool calls
- CFG090 instruction directs the agent to scan or enumerate an internal network
- CFG091 qwen-code auto-approves every tool call (tools.approvalMode: "yolo")
- CFG093 committed .cursor/permissions.json allowlist auto-approves terminal commands or MCP tools
- CFG094 committed .cursor/permissions.json autoRun.allow_instructions steers the auto-approval classifier
- CFG095 committed .cursor/sandbox.json weakens the agent's execution sandbox
- CFG096 committed Gemini MCP server declared trust: true
- CFG101 a deny rule constrains bundled short flags, which reordering walks past
- CFG103 a committed Codex config turns off, blunts, or rewrites Guardian v2
- CFG104 a committed Devin allow rule removes the approval prompt
- CFG105 a committed OpenCode permission block removes one of the two remaining prompts
- CFG106 a committed Codex config grants browser or desktop-application access
- CFG107 a committed Codex config injects code into every spawned shell
- CFG108 a committed scheduled_tasks.json runs prompts on a timer
- CFG109 a committed agent config file cannot be parsed
- CFG110 a Claude Code settings env block injects code into every hook and Bash command
- CFG111 a permission rule or hook matcher holds an invisible character, so it does nothing
-
Code the agent runs can change under it: unpinned MCP packages and images, plugins and marketplaces controlled by a committed file, remote installers piped into a shell, skills that ask to run a downloaded archive.
- CFG010 MCP server uses an unpinned package or image version
- CFG014 hook command downloads and executes remote code (curl | sh)
- CFG052 MCP server name declared in multiple config sources
- CFG055 committed settings enables a plugin or registers a marketplace
- CFG059 MCP server / hook package & endpoint typosquatting
- CFG062 Gemini CLI allows unrestricted Git extensions (security.blockGitExtensions)
- CFG067 hooks defined in a project-scoped settings file
- CFG070 MCP server command is a repo-relative path
- CFG074 skills-lock.json pulls skill content from an unpinned source
- CFG084 container image trust verification disabled
- CFG086 committed agent hook runs on a zero-click event
- CFG089 Copilot repository settings auto-install third-party plugins
- CFG098 marketplace.json publishes a plugin nothing pins
- CFG100 Grok [plugins] turns plugins on or widens where they load from
- CFG102 two committed skills claim the same name, and one is silently dropped
- CFG114 committed agent plugin or extension code runs from the repository
-
Training data, fine-tuning sets and model weights are not part of an agent's configuration files.
-
Rate limits, quotas and spending caps are set at the model provider or gateway, not in the repository.
-
Whether an answer is correct is a property of the model's output at run time, not of the files that configure the agent.
-
What a model reveals of its hidden context happens in a conversation, after the configuration has been read.
-
Vector stores and retrieval pipelines live in the application, not in the agent's configuration files.
-
How an application handles model output is in its code, which cfgaudit does not analyse.
OWASP MCP Top 10
Rules about MCP servers also name a category of the OWASP MCP Top 10. They cover 8 of its ten risks.
-
Tokens and keys written into MCP server definitions, headers and environment blocks.
- CFG021 MCP server env routes traffic through a non-local proxy
- CFG049 remote MCP server URL points to a non-loopback host
- CFG050 hardcoded secret in an MCP server env or headers
- CFG054 high-entropy value that looks like a hardcoded secret
- CFG058 MCP server uses the deprecated sse transport
- CFG068 templated credential forwarded to a cleartext / raw-IP MCP endpoint
- CFG069 HTTP-transport MCP server without log redaction
- CFG075 MCP server disables TLS certificate verification (MITM kill switch)
-
Servers that are approved wholesale or get more access than one task needs.
-
Tool and server metadata that carries instructions for the model.
-
Server packages and images that are not pinned and can change after review.
-
Server commands that are inline shell scripts or interpreters running code from their arguments.
-
Content the server returns that the agent is told to trust or act on.
-
Remote servers reached without authentication or over plain HTTP.
-
Audit logs and telemetry of MCP calls are produced at run time, not declared in a configuration file.
-
Servers that take over a trusted name or are added without review.
-
What context a server receives during a session depends on the conversation, not on the committed configuration.
Category names and links are from OWASP's lists. A rule names one LLM category and at most one MCP category.