MCP Governance & Risk Framework
A governance framework and set of documents that help organizations decide whether to allow a given MCP server, classify its risk and set the right controls before adopting it.
This OWASP project is a practical governance framework for organizations adopting the Model Context Protocol, the open standard that lets AI agents connect to external tools, data sources and systems. It answers one central question for a given MCP server: should it be allowed in the environment, and under what controls.
The main guide covers server inventory, a classification model, a risk-scoring model, governance principles and rollout guidance across six chapters, with a closing appendix holding a control catalog, an evidence pack, client and host governance, and detection and incident response guidance. A companion document maps the framework's controls to the OWASP MCP and LLM Top 10 lists, the NIST AI Risk Management Framework, ISO 42001 and SOC 2, and a further document curates external links on MCP security and threat modeling.
It is a set of markdown documents rather than software, maintained by an OWASP contributor.