10 Free OWASP MCP Top 10 Exercises

Every category in the OWASP MCP Top 10 now has a dedicated exercise on RansomLeak. Ten scenarios covering the ten ways the connection between an AI agent and its tools fails. All free, no account required.

The OWASP MCP Top 10 lists the security risks of the Model Context Protocol, the standard that lets agents call external tools and read external data. This course turns each category into a scenario you work through rather than a definition you read.

The OWASP MCP Top 10 training course is a set of ten interactive exercises, one for each risk category in the OWASP MCP Top 10. Model Context Protocol is the standard that connects AI agents to tools, data sources, and services, and the OWASP list ranks what goes wrong at that connection: leaked tokens, over-broad scopes, poisoned tool descriptions, tampered dependencies, command injection, subverted intent, missing authentication, absent audit trails, unregistered servers, and context that crosses between customers. Each exercise puts you inside a working system where one of those failures is already in progress, then asks you to find it, contain it, and verify the fix held. Exercises run in the browser as interactive simulations, take five to ten minutes each, and need no account or installation. The course sits in the AI & LLM Security catalogue beside the LLM and agentic courses.

The course covers all ten OWASP MCP risk categories:

1. Leaked MCP Tokens: A long-lived token in a config file is echoed into a chat transcript, then replayed against the real customer API
2. Agent Scope Creep: Leftover OAuth scopes let a triage agent paste a private signing key into a public thread
3. Poisoned Tool Descriptions: An approved tool’s description is rewritten to make the agent BCC every message to an outside address
4. Typosquatted MCP Package: A postinstall hook on a lookalike dependency ships credential files before anyone reads the code
5. MCP Command Injection: A semicolon in a tool argument opens a root reverse shell while the tool returns an empty result
6. Hijacked Agent Intent: An instruction planted through a public support form makes a summarizing agent email billing details out
7. Unauthenticated MCP Server: An approved server bound to 0.0.0.0 answers tools/list with finance data and no credential
8. Missing MCP Audit Trail: A complaint lands inside a two-day logging gap, and nothing configured afterwards recovers it
9. Shadow MCP Servers: A discovery scan turns up three running servers that no client configuration ever listed
10. Cross-Tenant Context Leak: One customer’s invoice and card details surface in another customer’s session with no tool misused

Each exercise ends with a fix and a replay, so you see the same attack fail against the corrected configuration.

MCP moved from a single vendor’s protocol to shared infrastructure in about a year, and tool connections are now something individual employees add themselves. The governance usually lags the adoption.

The measured picture is not reassuring. Equixly assessed popular MCP implementations and reported in March 2025 that 43% carried command injection flaws, 22% allowed path traversal or arbitrary file reads, and 30% permitted unrestricted URL fetching. Of the vendors it notified, 45% dismissed the findings as theoretical and 25% did not respond at all.

Invariant Labs published the first widely cited tool poisoning research in April 2025, showing that a server can earn approval on honest wording and change that wording afterwards. Neither of those failures produces an alert in a standard monitoring stack.

The practical problem is that MCP risks look like ordinary work while they happen.

Somebody approves a tool. Somebody asks an assistant to debug a broken connection and pastes the config in. Somebody spins up a server for an afternoon test and never turns it off.

Training that ends at the definition does not change what any of those people do next.

The three courses map to three layers, and they fail in different places.

The LLM course works at the model layer. You manipulate inputs and observe harmful outputs, and the attack surface is what the model reads and writes.

The agentic course works at the autonomy layer. You watch an agent chain decisions across many steps and intervene before a compounding error becomes irreversible.

This course works at the tooling layer, and the model is frequently doing nothing wrong. In the unauthenticated server exercise, no prompt is manipulated and no output is misleading. A service that should have demanded a credential answered without one, and the agent used it exactly as designed.

The same holds for the cross-tenant context leak. You prove from the tool trace that every lookup fetched the correct record, which is what makes it hard to detect. The leak came from context scope, not from a broken access control.

That shift changes what a learner practices. LLM and agentic exercises train judgment about model behavior. MCP exercises train configuration review, trace reading, and the habit of asking who is on the other end of a connection.

Sequence by who can actually cause or catch each failure.

Everyone using connected AI tools should run Poisoned Tool Descriptions and Hijacked Agent Intent. Both attacks arrive through ordinary work, and both are triggered by approving something or asking an assistant to summarize something. Neither requires the learner to have configured anything.

Engineers and platform teams should add Leaked MCP Tokens, Typosquatted MCP Package, MCP Command Injection, and Unauthenticated MCP Server. These are the four that get decided at integration time, when a token gets written into a config, a dependency gets installed, an argument gets pasted into a shell string, or a server gets bound wider than intended.

Security and IT teams should run Shadow MCP Servers, Missing MCP Audit Trail, and Cross-Tenant Context Leak. All three are discovery problems. You cannot prevent them from a policy, and each rewards knowing what a healthy trace looks like before you need to read a broken one.

Anyone reviewing access should run Agent Scope Creep. It reframes an access review around what a permission reaches today rather than what it was originally requested for, which is the review question most quarterly processes skip.

Run the three OWASP AI courses in layer order and each one makes the next easier to read.

Start with the OWASP LLM Top 10 course if your organization has done no AI security training. Prompt injection and data poisoning are easier to recognize in a chatbot than in a tool manifest, and both patterns reappear in the MCP list under different names.

Add the agentic course for teams building or operating autonomous workflows. Its supply chain exercise covers plugins and tool definitions an agent loads at runtime, which is the same boundary the MCP course examines from the server side.

Run this course for anyone who connects agents to real systems. It is the layer where a training failure turns into a production credential, and it is also where the fixes are concrete: pin a version, scope a token, authenticate a server, turn logging on before you need it.

The wider risk picture is worth pairing with too. Unregistered MCP servers are a form of shadow AI, and tokens leaking through assistant transcripts is one route to AI data leakage by employees. Both posts cover the organizational side that a technical exercise does not.

---

All ten OWASP MCP Top 10 exercises are live in our AI security training catalogue. Start with Poisoned Tool Descriptions, read the OWASP MCP Top 10 explainer, or browse the full training catalogue to build a path for your team.

• OWASP MCP Top 10
• OWASP Top 10 for LLM Applications 2025
• OWASP Top 10 for Agentic AI Applications
• Equixly: MCP Servers, the New Security Nightmare (March 2025)
• Invariant Labs: MCP Tool Poisoning Attacks (April 2025)
• Model Context Protocol specification