Compliance mapping¶
Findings from this tool, mapped onto three published frameworks. Render one for any result bundle:
apiverity report ./bundle --format owasp-mcp
apiverity report ./bundle --format owasp-asi
apiverity report ./bundle --format owasp-api
Every control appears in every rendered report, including the ones this tool cannot assess. A mapping report that lists only the controls it hit reads as a clean bill of health for the rest, and that is the easiest way for a governance tool to mislead the person relying on it.
The control names and numbering below are quoted from the published frameworks. The mapping to this project's rules is api-verity-lab's own reading and is not endorsed by OWASP. A control with rules listed is one this tool can produce evidence for; it is not a claim that the evidence is sufficient.
OWASP MCP Top 10 v0.1 (beta)¶
Source: https://owasp.org/www-project-mcp-top-10/, published 2025. Read 2026-09-09.
| # | Control | Rules | Produced by |
|---|---|---|---|
| MCP01 | Token Mismanagement & Secret Exposure | MCP-AUTH-PLAINTEXT-TRANSPORTMCP-CALL-RESULT-CREDENTIALMCP-SHADOW-INLINE-CREDENTIAL |
drift, mcp-inventory |
| MCP02 | Privilege Escalation via Scope Creep | MCP-LOCK-TOOL-ADDEDMCP-DRIFT-TOOL-UNDECLAREDBRK-RPC-ADDEDBUDGET- |
breaking, budget, drift, mcp-lock |
| MCP03 | Tool Poisoning | MCP-POISON-BRK-MCP-TOOL-DESCRIPTION-CHANGEDMCP-DRIFT-SCHEMA |
breaking, drift, mcp-lock, validate |
| MCP04 | Software Supply Chain Attacks & Dependency Tampering | MCP-LOCK-SIGNATURE-MCP-LOCK-UNSIGNEDMCP-LOCK-TOOL-MCP-SHADOW-FETCHED-AT-LAUNCH |
mcp-inventory, mcp-lock |
| MCP05 | Command Injection & Execution | not assessable | -- |
| MCP06 | Intent Flow Subversion | MCP-POISON-CROSS-TOOLMCP-POISON-INSTRUCTION |
validate |
| MCP07 | Insufficient Authentication & Authorization | MCP-AUTH- |
drift |
| MCP08 | Lack of Audit and Telemetry | not assessable | -- |
| MCP09 | Shadow MCP Servers | MCP-SHADOW-SERVERMCP-DRIFT-TOOL-UNDECLAREDMCP-LOCK-TOOL-ADDED |
drift, mcp-inventory, mcp-lock |
| MCP10 | Context Injection & Over-Sharing | MCP-POISON-INVISIBLE-TEXTMCP-POISON-HIDDEN-MARKUP |
validate |
What this tool cannot see¶
- MCP05 Command Injection & Execution — what a tool does with its arguments happens inside the server. A manifest declares the shape of an input, never what is done with it, and nothing this tool reads would distinguish a safe implementation from an injectable one
- MCP08 Lack of Audit and Telemetry — whether a server logs what it did is a property of its deployment. This tool produces an audit record of its own runs -- every artifact conforms to schemas/result-v1 and the self-hosted server hash-chains its events -- but that is evidence about this tool, not about the server it looked at
Where the coverage is partial¶
- MCP01 Token Mismanagement & Secret Exposure — the transport, a credential written into a client config, and a credential coming back in a tool result. How a server stores, scopes or rotates a token is still not something a manifest reveals
- MCP02 Privilege Escalation via Scope Creep — a growing tool surface is scope creep the contract can see; privileges the server holds behind those tools are not declared anywhere it can read
- MCP04 Software Supply Chain Attacks & Dependency Tampering — the tool surface you depend on changing under you, and a server launched with
npx/uvx, where the code that starts is whatever the registry serves today. It says nothing about the packages the server itself installs - MCP07 Insufficient Authentication & Authorization — established by probing tools/list with and without a credential. Whether individual tool calls are authorized is not tested, because testing it would mean calling them
- MCP09 Shadow MCP Servers —
apiverity mcp-inventoryfinds servers configured on this machine and absent from an approved list, by reading client configuration rather than scanning a network. A server nobody configured here, on a host nobody named, is out of reach of both
OWASP Top 10 for Agentic Applications v1.0¶
Source: https://genai.owasp.org/, published 2025-12-09. Read 2026-09-09.
| # | Control | Rules | Produced by |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | MCP-POISON-INSTRUCTIONMCP-POISON-CROSS-TOOLMCP-POISON-INVISIBLE-TEXT |
validate |
| ASI02 | Tool Misuse | MCP-ANNOTATION-MCP-DRIFT-BRK-MCP-BUDGET- |
breaking, budget, drift, mcp-lock, validate |
| ASI03 | Identity & Privilege Abuse | MCP-AUTH-SEC-AUTH-MCP-CALL-RESULT-CREDENTIALMCP-SHADOW-INLINE-CREDENTIAL |
drift, mcp-inventory, validate |
| ASI04 | Agentic Supply Chain Vulnerabilities | MCP-LOCK-MCP-SHADOW-FETCHED-AT-LAUNCH |
mcp-inventory, mcp-lock |
| ASI05 | Unexpected Code Execution | not assessable | -- |
| ASI06 | Memory & Context Poisoning | MCP-POISON-INVISIBLE-TEXTMCP-POISON-HIDDEN-MARKUP |
validate |
| ASI07 | Insecure Inter-Agent Communication | MCP-AUTH-PLAINTEXT-TRANSPORT |
drift |
| ASI08 | Cascading Failures | not assessable | -- |
| ASI09 | Human-Agent Trust Exploitation | MCP-POISON-INSTRUCTIONMCP-POISON-HIDDEN-MARKUP |
validate |
| ASI10 | Rogue Agents | not assessable | -- |
What this tool cannot see¶
- ASI05 Unexpected Code Execution — execution happens inside a tool implementation this tool never runs. The opt-in
--invoke-toolpath sends a call and checks the result against the declared outputSchema; it does not observe what executed - ASI08 Cascading Failures — a cascade is a runtime property of several agents interacting. Nothing in a contract, a diff or a single-server probe would show one
- ASI10 Rogue Agents — identifying an agent that has gone rogue needs observation of the agent. This tool looks at the contracts an agent is given, not at the agent
Where the coverage is partial¶
- ASI01 Agent Goal Hijack — covers hijacking delivered through a tool manifest, which is the surface this tool reads. A prompt reaching the agent by any other route is out of view
- ASI02 Tool Misuse — a tool whose declared safety hints contradict its name or its served behaviour is misuse waiting to happen; whether an agent actually misused one is a trace question, not a contract question
- ASI03 Identity & Privilege Abuse — a credential returned in a tool result enters the agent's context on every call, which is where inherited privilege starts
- ASI04 Agentic Supply Chain Vulnerabilities — the tool surface as the dependency, and a server fetched from a registry at launch; not the server's own dependencies
- ASI06 Memory & Context Poisoning — a poisoned description enters the agent's context every time the tool list is read. Poisoning of an agent's own stored memory is not visible here
- ASI07 Insecure Inter-Agent Communication — one leg of it: the transport between this client and one server. Agent-to-agent protocols are not among the six this engine reads
- ASI09 Human-Agent Trust Exploitation — text that a client renders differently from what the model reads is exactly this: the human approves one thing and the agent acts on another
OWASP API Security Top 10 2023¶
Source: https://owasp.org/API-Security/editions/2023/en/0x11-t10/, published 2023. Read 2026-09-09.
| # | Control | Rules | Produced by |
|---|---|---|---|
| API1 | Broken Object Level Authorization | not assessable | -- |
| API2 | Broken Authentication | SEC-AUTH-SEC-SCHEME-SEC-APIKEY-IN-QUERYSEC-BASIC-AUTHMCP-AUTH- |
drift, validate |
| API3 | Broken Object Property Level Authorization | SEC-ADDL-PROPERTIESBRK-RESP-FIELD-DRIFT-RESPONSE-CREDENTIAL |
breaking, drift, mcp-lock, validate |
| API4 | Unrestricted Resource Consumption | SEC-RATE-LIMIT-SEC-ABUSE-SEC-ARRAY-UNBOUNDEDSEC-COLLECTION-UNPAGINATEDBRK-CONSTRAINT-BUDGET- |
breaking, budget, drift, mcp-lock, validate |
| API5 | Broken Function Level Authorization | SEC-UNAUTH-WRITESEC-AUTH-MISSINGSEC-SCOPE- |
validate |
| API6 | Unrestricted Access to Sensitive Business Flows | not assessable | -- |
| API7 | Server Side Request Forgery | not assessable | -- |
| API8 | Security Misconfiguration | SEC-HTTPS-POLICYSEC-SENSITIVE-HEADERMCP-AUTH-PLAINTEXT-TRANSPORT |
drift, validate |
| API9 | Improper Inventory Management | DRIFT-MCP-DRIFT-TOOL-UNDECLAREDMCP-LOCK-TOOL-ADDEDBRK-OP-LIFECYCLE- |
breaking, drift, mcp-lock, validate |
| API10 | Unsafe Consumption of APIs | MCP-DRIFT-MCP-CONF- |
drift |
What this tool cannot see¶
- API1 Broken Object Level Authorization — BOLA is proved by calling one tenant's object with another tenant's credential. That is an authorization probe, not a contract check, and this tool does not perform one
- API6 Unrestricted Access to Sensitive Business Flows — which flows are sensitive is a business judgement no contract encodes. The stateful workflow engine can exercise a flow; it cannot decide it mattered
- API7 Server Side Request Forgery — SSRF is a property of what a server does with a URL it was handed. A contract declares that it takes a URL and stops there
Where the coverage is partial¶
- API2 Broken Authentication — the contract's authentication declarations, plus what a live MCP server serves anonymously. An endpoint protected by an undeclared gateway looks identical to an unprotected one from here
- API3 Broken Object Property Level Authorization — a response that grew a field, or a schema that accepts any property, is where over-exposure hides. Whether a returned field should have been visible to that caller is not something the contract states
- API4 Unrestricted Resource Consumption — undeclared limits from the contract -- an array a caller can send with no ceiling, a listing with no pagination, a page size with no maximum, a 429 that never says when to come back -- and observed call volume against a declared budget.
apiverity regressionmeasures latency; none of it measures what the service can actually absorb - API5 Broken Function Level Authorization — a mutating operation with no declared authentication is the documented case, and so is one whose OAuth requirement names no scope or a scope that grants everything -- both make the per-operation declaration decorative
- API9 Improper Inventory Management — this is the control this project is closest to being about: an endpoint serving something the contract does not declare, a tool surface that moved without review, and a deprecation with no retirement date -- an inventory problem is usually a version nobody retired
- API10 Unsafe Consumption of APIs — consuming an MCP server whose behaviour has diverged from its manifest is exactly this risk, from the consumer's side
How a rendered report grades a control¶
| State | Meaning |
|---|---|
| Findings | this run produced evidence against the control |
| Assessed, clear | rules mapped to the control ran in this artifact and found nothing |
| Not exercised by this run | rules exist, but the command that wrote the artifact does not produce them |
| Not assessable by this tool | nothing this tool can see speaks to the control; the reason is printed |
The third state is the one that matters. Without it, "no findings" means both checked and clean and never looked at, which is precisely the ambiguity an audit exists to remove.