OWASP MCP Top 10 Risks for Local Filesystem and Browser MCP Servers

What the OWASP MCP Top 10 covers

The OWASP MCP Top 10 is a documentation project on the security risks of systems that use the Model Context Protocol. As of November 2026, the project page was last updated on 8 November 2026. It describes the most critical concerns across the lifecycle of MCP-enabled systems, from model misbinding, context spoofing and prompt-state manipulation to insecure memory references and covert channel abuse. OWASP notes that these risks are amplified in agentic AI, model chaining, multi-modal orchestration and dynamic role assignment.

Four entries map most clearly to filesystem and browser servers. MCP02 is Privilege Escalation via Scope Creep: loosely defined permissions that expand over time and give agents excessive capabilities. MCP07 is Insufficient Authentication and Authorization: servers, tools or agents that fail to verify identities or enforce access controls. MCP08 is Lack of Audit and Telemetry: limited telemetry that impedes investigation and incident response. MCP09 is Shadow MCP Servers: unapproved deployments, often with default credentials or permissive configurations.

OWASP's MCP Security Cheat Sheet adds risks that matter for local servers: tool shadowing, over-scoped tokens and sandbox escapes. This guide uses those alongside the numbered entries. The mapping to server types is our analysis, not an OWASP statement.

Risk mapping for filesystem and browser servers

Relevance depends on what the server can touch. A filesystem server exposes local data and credentials. A browser server exposes live sessions and untrusted content. The table rates each risk by how directly it shows up in practice.

• MCP02 Scope creep: Filesystem: high. A root granted for one project widens to a home directory, and write access is added later. Browser: high. Access extends from one site to every logged-in session.
• MCP07 Insufficient authentication and authorization: Filesystem: high. Local servers run with delegated user permissions, so any caller inherits them. Browser: high. Page actions run with the user's authenticated identity.
• MCP08 Lack of audit and telemetry: Filesystem: high. Reads and writes need attribution to a tool call. Browser: high. Navigation, form entry and downloads need a record tied to the instruction that caused them.
• MCP09 Shadow MCP servers: Filesystem: high. Developers install local servers for convenience, often by package name. Browser: medium to high. Browser automation servers are easy to add without review.
• Tool shadowing and metadata drift: Filesystem: medium to high. A server approved as benign can change its tool metadata later and steer the agent toward local data. Browser: high. Page content is a second, uncontrolled source of instructions.
• Sandbox escape and over-scoped tokens: Filesystem: high. Full host access enables traversal and credential theft. Browser: high. Broad OAuth scopes and session cookies aggregate access.

Filesystem servers: how the risks appear

A local filesystem server typically offers read, write, list and search over a directory tree. OWASP guidance warns against giving MCP tools unrestricted filesystem, network or credential access on a developer's machine, and against local servers running with full host access. With that access, an agent can traverse directories, read credential files and, if the server permits execution, run arbitrary code.

Scope creep is the usual route. A server starts with a single project folder. Over time the root widens to the home directory, write access is added for one task and never removed. Because the server acts with the user's permissions, there is often no separate identity to authorize, which is where MCP07 applies. OWASP also notes that a .gitignore file affects only git. AI tools read from the filesystem directly, so a file excluded from version control is still readable by the agent.

Tool metadata drift is the less obvious path. OWASP's exploit roundup describes a server that appears benign when approved, then changes its tool metadata and uses a connected agent to reach sensitive local information, without the server reading those files itself. Review at approval time is therefore not enough. Typosquatted package names, such as a near-miss of a filesystem server's name, are a common way a malicious server gets installed in the first place.

Browser servers: how the risks appear

A browser server adds two properties a filesystem server lacks: it renders content the operator does not control, and it often operates inside authenticated sessions. In general terms, any text on a page can be read by the model as an instruction. A hidden element or a comment on a page can direct the agent to navigate elsewhere, submit a form or pass data to another tool. This is prompt injection through web content, and it is one realistic form of tool poisoning in a browser context.

OWASP's feed records a documented incident in which browser access amplified the consequence of Excessive Agency. That fits the pattern: the agent's permissions are ordinary, but the browser turns them into actions against real accounts. MCP02 applies when a server's reach grows from one site to every session in the profile. MCP07 applies because page actions inherit the user's identity without a separate check.

Some risks are less specific to these two server types. Categories such as model misbinding, insecure memory references and covert channel abuse sit mostly at the model, memory and protocol layers. In our analysis they matter for filesystem and browser servers, but they are not where these servers differ from other MCP servers, so they warrant less of the review effort here.

Enforcing policy on tool calls and producing evidence

Trussed enforces policy in the execution path of MCP tool calls: each call can be allowed, redacted, blocked, rate limited or escalated for human approval, enforced at runtime, not reviewed after the fact. This addresses the tool-call controls above for individual interactions. It does not substitute for sandboxing, server allowlists or scoped tokens, which remain deployment and configuration work.

Enforcement also produces audit-ready evidence. For MCP08, the useful artifact is a durable record of what was requested, which policy applied, what the decision was and what happened next, rather than raw server output. Trussed generates this evidence continuously from enforcement and maps it to frameworks including HIPAA, NAIC, NYDFS, the EU AI Act and NIST. It can be self-managed in the customer cloud, with configurable retention and data residency, which matters for a regulated enterprise handling local files and web sessions.