Is this a complete MCP security program?
No. This is not a claim of complete MCP security. The OWASP MCP Top 10 project is beta. HOL Guard is local-first runtime control, not a cloud MCP gateway or a full MCP security program.
OWASP MCP Top 10
How HOL Guard maps to the OWASP MCP Top 10
HOL Guard is local-first runtime control for shell, secrets, MCP server change, and plugin/skill install. It is not a cloud MCP gateway. This page maps Guard and the plugin-scanner to the published OWASP MCP Top 10. This is not a claim of complete MCP security. The OWASP project is beta.
HOL Guard is local-first runtime control for shell, secrets, MCP server change, and plugin/skill install — not a cloud MCP gateway.
Scanner is static/catalog scoring. The current public catalog scanner is a fallback static scan. A scan is not a safety guarantee.
Cursor owns native tool approvals; Guard does artifact trust / MCP sanity. Cursor/artifact trust is not full pre-exec on every MCP tool call.
Detect, prevent at runtime, and gap
Swipe horizontally on small screens to read detect, prevent, and gap columns.
| OWASP item | Detect | Prevent at runtime | Gap |
|---|---|---|---|
| MCP01:2025Token Mismanagement & Secret ExposureRelated guidance | Catalog and static scan flag secret-like headers, env, and token patterns in plugin and MCP metadata. The current public catalog scanner is a fallback static scan. Scan is scoring; a scan is not a safety guarantee. | Guard pauses secret-file reads (.env, keys) and exfil-shaped shell at the local action boundary. | Guard is not a secret-manager or a cloud MCP gateway. It does not prevent every token in model memory or third-party MCP server logs. |
| MCP02:2025Privilege Escalation via Scope Creep | Catalog scores overbroad tool scopes where metadata is visible. | Guard requires approval for MCP server change and plugin/skill install; permissions do not silently expand through those paths. | Guard does not continuously recertify every previously approved MCP tool scope inside the harness. Cursor native approvals remain Cursor-owned. |
| MCP03:2025Tool PoisoningRelated guidance | Scanner looks for poisoning patterns in tool descriptions and catalog metadata. | Guard models tool-description poisoning at the runtime boundary. Runtime benchmark fixtures are modeled. HOL publishes modeled fixtures. | Guard is not a complete prompt-injection preventer. Hidden instructions in arbitrary retrieved context can still steer the model before a governed action. |
| MCP04:2025Software Supply Chain Attacks & Dependency Tampering | Catalog scoring of plugin packages, including the public fallback static scan. | Guard can require approval on plugin/skill install and package-risk fixtures. | Not a full SBOM/signing gateway for every npm/pip install. Catalog scores are not Registry Broker agent counts. |
| MCP05:2025Command Injection & Execution | Limited static patterns in catalog metadata; not a dynamic fuzzer. | Guard intercepts risky shell at the local action boundary. | Not a sandbox for every interpreter the model might use. Coverage is harness- and event-specific. |
| MCP06:2025Intent Flow SubversionOn the same OWASP page, the Top 10 list names MCP06 Intent Flow Subversion, while the long-form heading is still Prompt Injection via Contextual Payloads. | Overlapping static signals with tool poisoning and prompt-like metadata. | Guard pauses governed actions (shell, secrets, MCP change, install) even if the model's intent was subverted. | Not a complete prompt-injection preventer. Intent can be hijacked in context HOL does not intercept. |
| MCP07:2025Insufficient Authentication & Authorization | Catalog may flag missing auth metadata when present in manifests. | Local approval boundary for high-risk actions; not identity federation. | Guard is not an IdP, MCP OAuth gateway, or network allowlist for remote MCP servers. |
| MCP08:2025Lack of Audit and Telemetry | Not applicable as scanner scoring. Guard produces local receipts for governed actions. | Receipts and private evidence stay local-first; public lessons only after redaction. | Not immutable enterprise SIEM. Local-first; cloud explainers are optional and redacted. Cursor/artifact trust is not full pre-exec on every MCP tool call. Cursor owns native tool approvals; Guard does artifact trust / MCP sanity. |
| MCP09:2025Shadow MCP ServersRelated guidance | The catalog does not inventory a developer's unsanctioned local MCP servers. | Guard can require approval when MCP server config is added or changed. | Does not discover every Shadow MCP process on the machine. |
| MCP10:2025Context Injection & Over-Sharing | Catalog cannot see live context windows. | Guard can block secret-file reads that would over-share into context. | Does not isolate or redact the model’s working memory across tasks. Not a context-firewall for every retrieval. |
Related resources
Questions
Does a catalog scan mean a plugin is safe?
No. Scanner is static/catalog scoring. The current public catalog scanner is a fallback static scan. A scan is not a safety guarantee.
Does HOL Guard stop prompt injection before the model reads it?
Guard is not a complete prompt-injection preventer. It pauses governed actions at the local boundary. Hidden instructions in retrieved context can still steer the model before a governed action.
Are catalog plugin scores the same as Registry Broker agent counts?
Catalog scores are not Registry Broker agent counts. The Hugging Face dataset default config is plugins in the catalog, which is distinct from Registry Broker. Browse /plugins for that split.
Are runtime benchmark results live attack measurements?
Runtime benchmark fixtures are modeled. HOL publishes modeled fixtures. They are not a live attack-resistance guarantee.