Migrated from nfvelten/arbitus#118
Summary
OWASP published the "MCP Top 10" — a standard list of MCP security risks analogous to the OWASP Web Top 10. Mapping Arbitus features to each risk category is a high-credibility, low-effort win that positions Arbitus as the security-first MCP proxy.
Deliverables
docs/owasp-mcp-compliance.md — table mapping each OWASP MCP Top 10 risk to the Arbitus feature that mitigates it, with config examples/dashboard compliance tab — widget showing which OWASP MCP risks are covered given the current config (e.g., if block_prompt_injection: false, Tool Poisoning shows as "not mitigated")
OWASP MCP Top 10 categories (partial)
- Tool Poisoning → payload filtering, schema validation
- Excessive Agency → tool allowlists, HITL
- MCP Rug Pull (tool definition changes) → schema cache + change detection
- Prompt Injection via Tools → prompt injection detection, encoding-aware filtering
- ...
References
- PROPOSAL.md §2.3
- OWASP MCP Top 10
Migrated from nfvelten/arbitus#118
Summary
OWASP published the "MCP Top 10" — a standard list of MCP security risks analogous to the OWASP Web Top 10. Mapping Arbitus features to each risk category is a high-credibility, low-effort win that positions Arbitus as the security-first MCP proxy.
Deliverables
docs/owasp-mcp-compliance.md— table mapping each OWASP MCP Top 10 risk to the Arbitus feature that mitigates it, with config examples/dashboardcompliance tab — widget showing which OWASP MCP risks are covered given the current config (e.g., ifblock_prompt_injection: false, Tool Poisoning shows as "not mitigated")OWASP MCP Top 10 categories (partial)
References