OWASP MCP Top 10 × Claude Code Hooks

MCP01: Token Mismanagement & Secret Exposure

Hardcoded credentials, long-lived tokens, secrets exposed in model memory or logs.

npx cc-safe-setup --install-example credential-file-cat-guard
npx cc-safe-setup --install-example credential-exfil-guard
npx cc-safe-setup --install-example hardcoded-secret-detector

Also: write-secret-guard, no-secrets-in-logs, output-secret-mask, no-default-credentials, staged-secret-scan

→ Credential Protection Guide

MCP04: Software Supply Chain Attacks

Compromised dependencies, unreviewed packages, dependency tampering.

npx cc-safe-setup --install-example dependency-install-guard
npx cc-safe-setup --install-example dependency-audit
npx cc-safe-setup --install-example npm-script-injection

Also: dependency-version-pin, check-dependency-age, check-dependency-license, no-force-install

MCP05: Command Injection & Execution

Unvalidated inputs leading to destructive system commands.

npx cc-safe-setup --install-example destructive-guard
npx cc-safe-setup --install-example no-eval
npx cc-safe-setup --install-example prompt-injection-guard

Also: rm-safety-net, sql-injection-detect, terraform-guard, no-exec-user-input

MCP09: Shadow MCP Servers

Unauthorized MCP servers bypassing security governance.

npx cc-safe-setup --install-example mcp-server-guard

Blocks modification of .mcp.json and unauthorized MCP server launches. Allowlist-based.