# OWASP MCP Top 10 — Assay Coverage Mapping

How Assay addresses the [OWASP MCP Top 10](https://owasp.org/www-project-mcp-top-10/) security risks.

| OWASP Risk | ID | Assay Coverage | How |
|-----------|-----|---------------|-----|
| Token Mismanagement & Secret Exposure | MCP01 | Strong (scoped) | Render-safety pipeline (control-strip → redact → bound → sink-encode) over the Assay CLI rendered sinks (console, `run.json`, SARIF, JUnit) and the Plimsoll review sinks, conformance-verified; redaction precedes bounding so a secret cannot survive as a truncated prefix. Proxy credential-boundary conformance (`assay.token_passthrough_conformance.v0`) shows a consumed inbound auth value is not re-emitted on outbound headers/body/env. Evidence lint also flags secrets in subjects (`ASSAY-W001`); policy can deny credential-exposing tools. Pattern-based detection, scoped to rendered sinks. Plimsoll consumer private. See note below. |
| Privilege Escalation via Scope Creep | MCP02 | Strong | `restrict_scope` enforcement limits tool arguments at runtime. Policy constraints enforce path/param boundaries. |
| Tool Poisoning | MCP03 | Strong | Tool signing (`x-assay-sig`), identity verification, tool metadata hashing. [Delegation spoofing experiment](../architecture/RESULTS-EXPERIMENT-DELEGATION-SPOOFING-2026q2.md) tested trust-domain verification. |
| Supply Chain Attacks & Dependency Tampering | MCP04 | Strong (scoped) | Offline verification of present Sigstore DSSE / Rekor v2 supply-chain evidence: artifact digest binding, pinned-root certificate chain (incl. ECDSA P-384 Fulcio CAs), Fulcio identity (SAN + issuer), DSSE/PAE signature, in-toto subject-digest binding, and Rekor v2 inclusion under pinned verifier material — composed into the coverage-honest `assay.supply_chain_conformance.v0` carrier with orthogonal per-dimension statuses — plus lockfile/digest pinning. Plimsoll consumes the carrier with incomplete-never-clean review semantics. Coverage limits stay explicit: timestamp freshness, Rekor consistency, witnessing, PEP 740 / npm adapters, absent provenance, registry-ecosystem security, and artifact/code safety are not proven. Plimsoll consumer private. See note below. |
| Command Injection & Execution | MCP05 | Strong | Policy `deny` rules block `exec`/`shell`/`bash`. Argument validation via regex constraints. Landlock sandbox for runtime isolation. |
| Intent Flow Subversion | MCP06 | Strong | Sequence policies detect tool-call ordering violations. [Memory poisoning experiment](../architecture/RESULTS-EXPERIMENT-MEMORY-POISON-2026q2.md) tested delayed payload reactivation. |
| Insufficient Authentication & Authorization | MCP07 | Strong | `approval_required` enforcement, mandate system with revocation, auth context validation. |
| **Lack of Audit and Telemetry** | **MCP08** | **Complete** | **Evidence bundles, decision logs, replay, diff, lint, SARIF output.** This is Assay's primary value proposition. |
| Shadow MCP Servers | MCP09 | Strong (scoped) | Assay inventory carrier (`assay.mcp_server_inventory.v0`, coverage-honest, command/args hashed) + Plimsoll allowlist review over scanned config/process sources; coverage limits reported. No absence claim outside scanned sources. Plimsoll consumer private. See note below. |
| Context Injection & Over-Sharing | MCP10 | Strong | `redact_args` enforcement strips sensitive fields. Context envelope hardening validates completeness. [Protocol evidence experiment](../architecture/RESULTS-EXPERIMENT-PROTOCOL-EVIDENCE-INTERPRETATION-2026q2.md) tested consumer-side interpretation. |

> **Note on MCP01 "Strong (scoped)".** "Strong" here means rendered outputs carry no raw credential / PII / terminal-control values. A render-safety pipeline redacts before bounding (so a secret cannot survive as a truncated prefix) across the Assay CLI rendered sinks (console, `run.json`, SARIF, JUnit) and the Plimsoll review sinks, proven by render-safety conformance over a hostile corpus; the proxy does not re-emit a consumed inbound auth value (token-passthrough conformance). Detection is pattern-based and may miss a novel secret format. Scope is rendered sinks — not capture-side redaction, and not token lifecycle / rotation / vaulting. The Assay CLI render-safety is public; the Plimsoll review consumer is currently private. It is not Complete coverage.
>
> **Note on MCP09 "Strong (scoped)".** "Strong" here means the workflow has deterministic producer evidence and a validated review consumer. The public Assay artifact is the inventory carrier (`assay mcp inventory`); the Plimsoll review consumer is currently private, so public users can reproduce the evidence producer but not the full review/gating path from this repository alone. It does not mean Assay detects all shadow MCP servers, and it is not Complete coverage.
>
> **Note on MCP04 "Strong (scoped)".** "Strong" here means Assay verifies the Sigstore DSSE / Rekor v2 supply-chain evidence that is present on an artifact — entirely offline, against pinned trust roots — and emits the coverage-honest `assay.supply_chain_conformance.v0` carrier, with certificate chain, Fulcio identity, DSSE/PAE, in-toto subject binding, and Rekor v2 inclusion kept as orthogonal per-dimension statuses (a verified transparency-log inclusion never launders a wrong identity or a wrong artifact subject). The Plimsoll consumer reviews the carrier with incomplete-never-clean semantics: a required check that is absent, unsupported, or unverifiable is never read as clean. The carrier producer is public; the Plimsoll review consumer is currently private, so public users can reproduce the producer but not the full review/gating path from this repository alone. It does not verify timestamp freshness, Rekor consistency, or witnessed checkpoint state; it does not cover PEP 740 / npm ecosystem adapters or registry-wide security; and it proves neither artifact safety nor absence of malicious behaviour. It is not Complete coverage.

## Summary

Assay now has no **Partial** rows in this mapping; MCP01, MCP04, and MCP09 remain explicitly **Strong (scoped)**. Scoped coverage means evidence-backed controls within Assay's verified boundary, not complete coverage of the risk category.

The strongest alignment is with **MCP08 (Lack of Audit and Telemetry)** — Assay's evidence bundles, decision logs, and replay capabilities are a direct and comprehensive answer to this risk.

## Security Experiments

Assay's coverage claims are backed by [three bounded security experiments](../architecture/SYNTHESIS-TRUST-CHAIN-TRIFECTA-2026q2.md) testing 12 attack vectors across producer, adapter, and consumer perspectives. All experiments achieved zero false positives under the full contract stack.