OWASP MCP Top 10 Emerges; mcp-audit Scanner Launches at RSA 2026
Adam Dudley released mcp-audit at RSA Conference 2026 — an Apache 2.0, offline-first CLI security scanner that maps findings to the emerging OWASP MCP Top 10 taxonomy. The tool covers 8 MCP clients, cross-server attack paths, 37 SAST rules across Python and TypeScript, and supply-chain checks. The offline-first design principle — "your config never leaves the machine" — directly addresses the irony of cloud-based security tools. The scanner integrates with CI pipelines, pre-commit hooks, and SARIF output.
Why It Matters
MCP server adoption is in the npm-package adoption window — explosive growth, immature tooling, no consensus on "secure." The OWASP MCP Top 10 taxonomy plus a free scanner gives the ecosystem its first standardised security vocabulary, mirroring the pattern that defined web application security a decade ago.