The OWASP lists, mapped
What a workstation's boundary does about each item on the OWASP MCP Top 10 and the OWASP Top 10 for Agentic Applications.
A verdict of “strong” means the mechanism is held outside the workstation. “Partial” means the boundary limits the damage but does not prevent the cause. “Little or none” means the risk sits somewhere the boundary does not reach. Every row assumes a workstation on vz, hcs, qemu or a cloud, and a row that mentions the allowlist or an injected key assumes you configured them.
The OWASP MCP Top 10
The OWASP MCP Top 10, a 2025 release still marked beta, covers the risks of running tools over the Model Context Protocol.
| Item | What the boundary does | Verdict |
|---|---|---|
| MCP01 Token Mismanagement & Secret Exposure | An injected key is added where the connection leaves the workstation, and nothing on the workstation can read, print or send it. A key you place on the workstation yourself is readable by every process there. | Strong for an injected key, none for a key you place inside |
| MCP02 Privilege Escalation via Scope Creep | The boundary limits the workstation, not what a key may do at the API that issued it. An injected key with write access still writes. | Partial |
| MCP03 Tool Poisoning | A poisoned tool’s commands run inside the VM, it can reach only the allowlist’s destinations, and its use of an injected key is counted at the Edge. It can still misuse a host that is allowed. | Partial |
| MCP04 Software Supply Chain Attacks & Dependency Tampering | A tampered package runs inside the VM and can call out only to allowed destinations. lifecycle.ttl deletes the machine and its disk at a deadline. | Strong for your machine, partial for what is inside the workstation |
| MCP05 Command Injection & Execution | Injection itself is not prevented. The command runs in a VM that shares no folder from your machine and, on vz and hcs, has no path to its services. | Strong for your machine |
| MCP06 Prompt Injection via Contextual Payloads | Injection itself is not prevented. An agent given a poisoned prompt reaches only allowed destinations and cannot read or move the injected key, but it can still act through a host that is allowed. | Partial |
| MCP07 Insufficient Authentication & Authorization | Who an MCP server lets in is decided by the server. The Edge’s one check, on an injected or inspected host, refuses a request whose Host header names a different host. | Little or none |
| MCP08 Lack of Audit and Telemetry | The Edge counts refused connections always, allowed connections under audit, and credential use by Integration and host. It records connections, not tool calls. | Partial |
| MCP09 Shadow MCP Servers | A policy judges the host in an MCP server’s URL, so an unapproved host is refused at apply, and a strict workstation reaches no host its allowlist leaves out. A server run inside the workstation is not prevented. | Partial |
| MCP10 Context Injection & Over-Sharing | Each workstation is its own VM, and lifecycle.ttl deletes it, disk included, at a deadline, so local state does not carry from one task to the next. Context held elsewhere is untouched. | Partial |
The Edge’s counts are per workstation and UTC day, kept for 90 days, and hold no request or response body.
The OWASP Top 10 for Agentic Applications
OWASP released the Top 10 for Agentic Applications for 2026 in December 2025.
| Item | What the boundary does | Verdict |
|---|---|---|
| ASI01 Agent Goal Hijack | Not prevented. Execution stays inside the VM, and the agent can reach only the allowlist’s destinations. | Partial |
| ASI02 Tool Misuse and Exploitation | An allowlist held outside the workstation limits where a tool can connect. A tool can still misuse a host that is allowed. | Partial |
| ASI03 Identity and Privilege Abuse | An injected key is never on the workstation. The workstation’s own identity can read its own record and nothing more by default, and on AWS and Azure it has no cloud identity unless given one. | Partial |
| ASI04 Agentic Supply Chain Vulnerabilities | A compromised tool or package runs inside the VM, and the gitSources and egressDestinations limits in a policy decide where code and MCP servers may come from. The boundary does not stop a poisoned prompt. | Partial |
| ASI05 Unexpected Code Execution (RCE) | The code runs inside a VM that shares no folder from your machine and, on vz and hcs, has no path to its services. | Strong for your machine |
| ASI06 Memory & Context Poisoning | Memory kept inside the workstation goes with it when the workstation is deleted. A memory store outside it is untouched. | Partial, for memory kept inside |
| ASI07 Insecure Inter-Agent Communication | The allowlist limits which hosts an agent can talk to and says nothing about what the messages contain. | Little or none |
| ASI08 Cascading Failures | One workstation can reach only its allowlist’s destinations, and maxRunTime stops a run at a fixed length. A fault can still spread through the hosts it may reach. | Little or none |
| ASI09 Human-Agent Trust Exploitation | Nothing here addresses it. | Little or none |
| ASI10 Rogue Agents | A rogue agent stays inside a VM whose reach is fixed outside it. Under audit, rl workstation egress <name> --allowed shows what it reached, and spec.stopped stops it. | Partial |
Where to go next
These pages continue from here: