Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
LLM-MCP-Security-Field-Guide — The most comprehensive LLM + MCP security guide i.e. OWASP aligned, real CVEs, actionable checklists | Kitploit
Tools/GitHubGitHub/pathakabhi24/llm-mcp-security-field-guide
Vulnerability AnalysisPenetration TestingThreat IntelligenceSupply Chain SecurityPapers & ResearchLearning & EducationRed TeamingCurated ResourcesLearning Paths & Courses
AI Security
GitHubpathakabhi24/llm-mcp-security-field-guide

LLM-MCP-Security-Field-Guide

The most comprehensive LLM + MCP security guide i.e. OWASP aligned, real CVEs, actionable checklists

View Repository
3295 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🛡️ AI Security Field Guide — LLM + MCP Security

The most comprehensive, up-to-date, practitioner-first security reference for LLM applications and Model Context Protocol (MCP) deployments.
Covers real CVEs, live attack patterns, OWASP frameworks, red teaming tools, and actionable checklists — updated weekly.

Stars Forks Updated OWASP PRs Welcome

Why This Guide Exists

The AI security landscape shifted dramatically in 2025–2026:

  • 🔴 492 MCP servers publicly exposed with no authentication (Trend Micro, 2026)
  • 🔴 CVE-2025-6514 compromised 437,000+ developer environments via mcp-remote OAuth proxy
  • 🔴 1,184 malicious skills confirmed across the ClawHub agent registry (Antiy CERT, 2026)
  • 🔴 Claude Code RCE vulnerability (CVE-2025-59536, CVSS 8.7) — triggered by opening a repo
  • 🔴 OWASP released 2 new frameworks: LLM Top 10 (2025) + Agentic Top 10 / ASI (Dec 2025)

    • Most tutorials show you how to build with MCP and LLMs. Almost none show you how to secure them. This is that guide.

    Table of Contents

    Part 1 — LLM Security (OWASP LLM Top 10)

    • LLM01: Prompt Injection
    • LLM02: Insecure Output Handling
    • LLM03: Training Data Poisoning
    • LLM04: Model Denial of Service
    • LLM05: Supply Chain Vulnerabilities
    • LLM06: Sensitive Information Disclosure
    • LLM07: Insecure Plugin Design
    • LLM08: Excessive Agency
    • LLM09: Overreliance
    • LLM10: Model Theft

    Part 2 — MCP Security (OWASP MCP Top 10)

    • MCP Attack Surface Overview
    • MCP01: Token Mismanagement
    • MCP02: Tool Poisoning
    • MCP03: Prompt Injection via MCP
    • MCP04: Confused Deputy Attacks
    • MCP05: Supply Chain Attacks
    • MCP06: Context Poisoning
    • MCP07: OAuth Misconfiguration
    • MCP08: SSRF via Fetch Servers
    • MCP09: Scope Creep
    • MCP10: Insecure Transport
    • Real CVE Database

    Part 3 — OWASP Agentic Top 10 (ASI 2026)

    • ASI01: Agent Goal Hijack
    • ASI02: Tool Misuse
    • ASI03: Identity & Privilege Abuse
    • ASI04–ASI10: Full Coverage

    Part 4 — Red Teaming

    • Methodology
    • Tools Reference
    • Attack Library

    Part 5 — Checklists

    • MCP Security Checklist
    • LLM App Checklist
    • Agentic System Checklist

    Real CVE Quick Reference

    CVECVSSComponentImpact
    CVE-2025-6514CRITICALmcp-remote (558k+ downloads)RCE, 437k+ environments compromised
    CVE-2025-595368.7Claude CodeRCE via .claude/settings.json Hook injection
    CVE-2026-218525.3Claude CodeAPI key theft via request redirection
    CVE-2026-283639.9OpenClawLocalhost WebSocket hijack → data exfiltration
    CVE-2025-655139.3mcp-fetch-serverSSRF → internal network access
    CVE-2025-68145/43/44HIGHmcp-server-gitPath bypass + RCE chain

    Live tracker: vulnerablemcp.info

    Frameworks Covered

    FrameworkScopeReleased
    OWASP LLM Top 10 (2025)LLM application risksNov 2024
    OWASP Agentic Top 10 (ASI 2026)Autonomous agent risksDec 2025
    OWASP MCP Top 10MCP protocol risks2025 (Beta)
    OWASP Agentic Skills Top 10Agent skill/plugin risksQ1 2026
    MITRE ATLASAdversarial ML tacticsOngoing
    NIST AI RMFGovernance framework2023

    Red Teaming Tools

    ToolBest for
    DeepTeam50+ vulnerabilities, OWASP/NIST/MITRE frameworks
    promptfooCI/CD integration, OWASP plugin mapping
    Garak100+ automated vulnerability probes
    PyRITMicrosoft's orchestration framework
    agent-scanMCP server + agent skill scanner

    Contributing

    Contributions are welcome. See CONTRIBUTING.md.

    • Found a new CVE? Open an issue.
    • Better mitigation code? Submit a PR.
    • New attack pattern? Document it.

    License

    CC BY 4.0 — Free to use, share, and build on with attribution.

    ⭐ Star this repo if it helped you secure something. It helps others find it.

    Download Tool