Loading…
← Back to schedule
Pre-Flight Security Review for MCP Servers Using the OWASP MCP Top 10
Friday November 6, 2026 3:30pm - 4:15pm PST
Room: Grand Ballroom B (Street Level)
Since Anthropic released MCP as an open standard, enterprises have started adopting it as a common way to connect AI agents with tools, data sources, and business workflows. Many teams are now building MCP catalogs for internal developers, platform teams and external partners.

However, the security posture of these MCP servers is often not reviewed before they are added to a catalog or connected to an AI agent. In many cases, deeper security testing starts only after the MCP server is already in use.

Recent research has shown how a malicious or poorly reviewed MCP server can expose sensitive data, influence an agent’s behavior or override instructions given by the user. This makes MCP discovery an important early checkpoint for developer pre-flight checks, security approval, third-party MCP review, vendor or partner assessment and agent platform onboarding.

For traditional applications, software bills of materials (SBOMs) and configuration drift checks help teams understand what is being adopted and what has changed. MCP servers need a similar approach. In this talk, I will walk through a three-layer MCP BOM model: Discovery, Verified, and Runtime.

I will focus on the Discovery BOM and show how static MCP discovery can surface early indicators of tool poisoning, command injection and execution, context injection and over-sharing, credential-like inputs and risky tool capabilities. I will demonstrate this using an open-source tool that discovers MCP metadata and capabilities, runs static checks with YARA rules and maps findings to the OWASP MCP Top 10.

The goal is not just to scan an MCP server once, but to use discovery output as a pre-flight check: to review MCP servers before approval, detect MCP configuration and metadata changes in CI/CD, build safer MCP catalogs and create the first version of runtime monitoring and policy decisions.

Attendees will leave with a practical way to inspect MCP servers before agents use them, map exposed capabilities to OWASP MCP risks, compare MCP configuration drifts over time and answer a basic but important question during MCP security review: "What should be allowed, reviewed, or denied before the agent uses this MCP server?"
Speakers
avatar for Vinothini Raju

Vinothini Raju

Founder & CEO, gopaddle.io
Vinothini Raju, is the Founder & CEO at gopaddle.io. She has been awarded the B2B Woman Tech Entrepreneur of the Year, 2023 by Women In Cloud & Insight Enterprises. Under her leadership, gopaddle focuses on building a next-generation platform for cloud native applications​. Her... Read More →
Friday November 6, 2026 3:30pm - 4:15pm PST
Room: Grand Ballroom B (Street Level)
  Implementation

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share

Get help with the event

Contact event planner Event login
View support guides Find upcoming events
Create an event you'd love to attend!
Explore why organizers choose Sched • Success stories
Event App • Event scheduling • Event registration • Event ticketing • Sched forms • Call for papers • Badges • Conferences
© 2026. SCHED LLC - All rights reserved - Helping events since 2008
Conference Scheduling Software • Privacy • Terms
Share Modal

Share this link via

Or copy link