Can you list every MCP server your agents are calling right now? Most teams can’t.
We keep framing MCP security as “does this server have a vulnerability.” That’s the wrong level. The agent calling that server holds real credentials and real permissions, and it will act on instructions from a tool description nobody verified. Your code can be clean and you still have a problem.
I’m spending an hour on this on October 27, 11am ET. The incidents that made the news and what actually went wrong, where the trust chain breaks, and the hardening worth shipping first. Plus the OWASP MCP Top 10 as a risk lens, not a checklist.
Running agents in your dev environment? Come join. 1 CPE if you attend live. https://snyk.co/utcRG
#snyk #owaspmcptop10