owasp_mcp_name: Token Mismanagement & Secret Exposure

detect: catalog/advisory secret-exfil + mcp-token-theft

prevent: Guard can block secret-file / env reads at the local action boundary

gap: not a secrets manager; does not rotate tokens; does not scrub secrets already inside model context


owasp_mcp_name: Privilege Escalation via Scope Creep

detect: tool-permission-creep advisory

prevent: Guard approval on plugin/skill install and MCP server change

gap: not an OAuth scope-expiry gateway


owasp_mcp_name: Tool Poisoning

detect: tool-description-poisoning advisory + scanner MCP posture

prevent: Guard on changed MCP servers / plugin install

gap: Cursor path is artifact trust, not full pre-exec of every tool description


owasp_mcp_name: Software Supply Chain Attacks & Dependency Tampering

detect: catalog scores, lockfile/publishability findings, supply-chain advisories

prevent: Guard on plugin/skill install

gap: not a signing/SBOM authority


owasp_mcp_name: Command Injection & Execution

detect: unsafe-command / rm-rf advisory

prevent: Guard intercepts local shell/file-destructive actions

gap: does not sandbox every MCP server's own backend


owasp_mcp_name: Intent Flow Subversion

detect: several prompt-injection advisories (Intent Flow Subversion / contextual payloads)

prevent: limited (some injected-instruction to shell paths hit Guard)

gap: NOT a complete prompt-injection preventer


owasp_mcp_name: Insufficient Authentication & Authorization

detect: MCP transport hardening (insecure HTTP, wildcard binds, missing auth posture) on Guard pages

prevent: local only

gap: not an MCP gateway identity layer


owasp_mcp_name: Lack of Audit and Telemetry

detect: local decision trail / receipts on the developer machine

prevent: local decision trail / receipts

gap: not an immutable SIEM; local logs


owasp_mcp_name: Shadow MCP Servers

detect: shadow-mcp-server-discovery advisory

prevent: Guard on new/changed MCP servers before the harness launches

gap: not continuous org-wide network discovery of shadow servers


owasp_mcp_name: Context Injection & Over-Sharing

detect: context-window-scraping / data-overexposure advisories

prevent: Guard on excessive local file reads

gap: does not quarantine or partition model context windows