The Model Context Protocol (MCP) is a standard for allowing AI models to connect with external tools and data. It acts as a communication layer, similar to how APIs work. With this power comes a new class of vulnerabilities and attack surfaces that remain underexplored.
To help organizations address these risks, the widely recognized Open Worldwide Application Security Project (OWASP) has released the MCP Top 10. This framework outlines the most critical security concerns in MCP-enabled systems and provides actionable guidance for identifying and mitigating them.
Many of these risks outlined in the top 10 can be mitigated through dynamic, runtime authorization, which ensures that both humans and AI agents only access what they’re allowed to.
In this article, we map the different OWASP MCP risks to practical authorization controls for securing, monitoring, and auditing AI systems. With correctly implemented policy-based authorization, up to 6 of the 10 identified risks can be effectively mitigated.
Where authorization sits in MCP architecture
When applying authorization to MCP, it helps to treat MCP the same way you would secure APIs. The architectural patterns recommended in NIST 800-207 Zero Trust framework provides a useful blueprint for doing this consistently and securely.
Below is a diagram showing the MCP request flow with Axiomatics runtime authorization components:
Mapping authorization to the OWASP MCP Top 10
MCP01 – Token Mismanagement & Secret Exposure
Token mismanagement and secret exposure occurs when credentials are hard-coded, tokens are long-lived, or secrets are stored in MCP memory or protocol logs. These practices increase the risk of exposing sensitive environments to unauthorized access. Attackers can exploit these exposures through prompt injection, compromised context, or debug traces, potentially performing high-impact actions
Runtime authorization mitigates this risk by:
- Policy-based access checks: Every tool or resource call requires runtime verification against dynamic policies, ensuring the right user or agent only accesses the information they are authorized for.
- Secure handling of secrets: Sensitive credentials are never persisted in MCP memory or logs; access to secrets is mediated through authorization checks at the moment of request.
Example of authorization in action
An employee uses an AI assistant to analyze financial data and submits a prompt that would access sensitive revenue figures that they aren’t authorized to see. Runtime authorization evaluates the request in real time, checking their role, session context, and data sensitivity. Because the employee lacks the necessary permissions they system blocks the request, preventing AI from exposing confidential information.
MCP02 – Privilege Escalation via Scope Creep
Privilege escalation can occur when permissions within an MCP server are loosely or coarsely defined and gradually expand over time, giving agents access to more tools and actions than originally intended. Attackers can exploit these accumulated privileges to perform unintended or high-risk operations.
Fine-grained authorization helps prevent this by enforcing least privilege and continuously evaluating access at runtime. This is typically achieved through:
- Attribute-based access control (ABAC): Access is granted based on identity, agent type, task, and context rather than static roles or scopes.
- Just-in-time permissions: Agents receive only the capabilities they need for the current operation.
- Dynamic policy evaluation: Permissions can be revoked or restricted as context changes, preventing long-term privilege creep.
Example of authorization in action
A customer support agent uses an AI assistant to retrieve order status but is not authorized to issue refunds above a set threshold. When the MCP server orchestrates requests across systems, runtime authorization ensures every step is checked against fine-grained policies based on context. This prevents privilege escalation by stopping the agent from chaining actions or accessing data beyond its scope. As a result, organizations maintain real-time control over AI behavior, reducing the risk of overreach, data exposure, and unintended actions.
MCP07 – Insufficient Authentication & Authorization
Insufficient authorization occurs when MCP servers, tools, or agents fail to properly enforce access controls during interactions. This often happens when traditional, coarse-grained approaches are used. In MCP ecosystems where multiple agents, users, and services exchange data and perform actions, insufficient or absent identity validation creates significant attack vectors and heightens the risk of unauthorized access and malicious activity.
Runtime authorization mitigates this risk by:
- Centralized policy enforcement: Ensures all MCP components follow consistent access rules across the ecosystem.
- Identity propagation and validation: Verifies the identity and role of each agent at every interaction, rather than relying on static permissions.
- Dynamic, context-aware access: Grants or revokes permissions in real time based on factors like agent type, requested action, and resource sensibility.
Example of authorization in action
An AI agent assisting with financial reporting may pull data from multiple systems, with each request evaluated in real time by centrally defined, context-aware policies. If access is allowed in one system but not another, the agent is blocked from retrieving authorization data, preventing inconsistent or overly permissive access. This keeps all interactions aligned with enterprise-wide policies.
MCP08 – Lack of Audit & Telemetry
A lack of auditing and telemetry within MCP servers and agents undermines compliance efforts and makes effective incident response difficult. Without detailed visibility into tool invocations, context changes, and user-agent interactions, organizations may be unavailable to detect misuse, investigate security events, or demonstrate regulatory compliance.
Runtime authorization improves auditing and compliance by:
- Comprehensive decision logging: Every authorization decision is recorded, creating a detailed and traceable audit trail.
- Centralized visibility: Externalized authorization provides a single location to monitor access patterns across agents, tools, and MCP servers, simplifying investigations and compliance reporting.
- Context-rich telemetry: Because decisions are based on dynamic attributes such as identity, task, and resource sensitivity, audit logs capture not just what was requested, but why access was granted or denied.
Example of authorization in action
When an AI agent accesses sensitive customer or financial data, each action is logged with context creating a complete audit trail. If a compliance officer needs to investigate a potential data misuse incident they can quickly review these logs to see exactly which AI actions were taken under which policies. This fills MCP’s auditing gap, helping enterprises meet regulatory requirements.
MCP09 – Shadow MCP Servers
“Shadow MCP Servers” refers to unapproved or unsupervised deployments of MCP, similar to Shadow IT. These instances are often created for experimentation or convenience and typically operate with default credentials, permissive configurations, or unsecured APIs. Because they exist outside formal security governance, they introduce significant visibility and access control risks.
Without centralized oversight, agents and users may connect to these servers and access sensitive tools or data without proper authorization or monitoring.
Runtime authorization helps address this risk by:
- Enforcing access to approved MCP endpoints: Agents and users are restricted to connecting only to registered and trusted MCP servers.
- Centralized governance: Authorization policies act as a control plane for managing which internal users, suppliers, and partners can access MCP services.
Example of authorization in action
In an enterprise environment, runtime authorization mitigates shadow MCP servers by enforcing centralized, policy-driven access across all AI agents and tools, even those deployed unofficially. For example, if a business unit spins up an unsanctioned MCP instance to experiment with AI workflows, runtime authorization evaluates every request from that instance in real time against the organization’s central policies. This prevents unauthorized access to sensitive data or systems, ensuring all AI activity is governed consistently.
MCP10 – Context Injection & Over-Sharing
Within MCP, context serves as a working memory layer that stores prompts, retrieves data, and intermediate outputs across agents or sessions. If shared too broadly, retained too long, or poorly scoped, it can expose sensitive information. This “context over-sharing” turns convenience into risk when data meant for one agent may be reused in another without proper controls.
Runtime authorization mitigates this risk by:
- Enforcing context-level access controls: Access to stored prompts, retrieved documents, and session memory is checked against policies before being shared with other agents or users.
- Evaluating access dynamically: Authorization decisions are made at the time context is requested or reused, ensuring that changes in identity, role, or task are reflected in real time.
Example of authorization in action
If an AI agent is given a prompt containing sensitive HR data, authorization ensures the agent is authorized to retrieve the data and can’t pass it to other agents or systems that aren’t authorized to view that information. By evaluating each request against policies that consider data sensitivity and user role, the MCP servers prevent accidental or malicious sharing of information, keeping sensitive data compartmentalized and reducing the risk of leaks or misuse across agents and workflows.
A closer look at OWASP MCP top 10 & authorization
The table below summarizes how runtime authorization helps mitigate each risk in the OWASP MCP Top 10, providing a consistent control layer across agents and tools.
| OWASP Risk | What can go wrong | Authorization reduces the risk |
|---|---|---|
| Token mismanagement & secret exposure | Stolen or leaked tokens allow agents to access tools and data | Require policy checks on every tool call |
| Privilege escalation via scope creep | Agents gradually accumulate permissions and exceed intended scope | Apply least-privilege policies and continuously evaluate entitlements |
| Insufficient authentication & authorization | Tools and MCP servers cannot verify who or what is making requests | Propagate identity through MCP and enforce centralized policy decisions |
| Lack of audit and telemetry | No record of which agent accessed which tools or data | Log and authorize every action to create a verifiable audit trail |
| Shadow MCP servers | Unsanctioned MCP endpoints operate outside governance | Restrict agents to approved MCP servers using policy-based allow-listing |
| Context injection & over-sharing | Shared context leaks data between users, sessions, or agents | Enforce context-level access controls |
The future of AI security & authorization
As organizations continue to adopt AI and build systems around MCP, the security challenges outlined in the OWASP MCP Top 10 will need to be addressed. Runtime authorization provides a consistent way to address these challenges by enforcing least privilege at every interaction in the moment and creating a centralized audit trail.
As AI systems grow more autonomous, organizations that invest in policy-driven authorization today will be better positioned to scale securely, maintain compliance, and confidently adopt more advanced AI capabilities in the future.
If you want to learn more about securing AI, we recommend the following guides:
- Securing the AI frontier: A CISO’s guide to access control for MCP
- Secure your AI agents and MCP gateways with policy-driven authorization (webinar)
- Secure your RAG: Where to start?
If you have additional questions or would like to see a demo, please reach out to us and our solution experts would be happy to connect with you.
This article builds on concepts discussed in OWASP MCP Top 10, which is licensed under Creative Commons BY-NC-SA 4.0.
All interpretations, opinions, and solution approaches in this post are independently developed by Axiomatics.